If those transitive dependencies are baked into the language runtime, how is anything materially different? You just shift the vector around.
If those transitive dependencies are baked into the language runtime, how is anything materially different? You just shift the vector around.
Because the standard library of a programming language has a lot more eyes on it than one of the many small dependencies does.
You are just shifting where the eyes are, the amount of eyeballs (developer time) is the same. Unless the proposal is to increase the amount of (other) developers time.
The proposal ends up amounting to either shifting stuff around, or asking to other people to put in more effort? Into a project that usually doesn't pay (programming languages and runtimes)
Which by the way, asking other people to do stuff for free IS the attack vector, if you are the kind of dev or company that gets hit by these, your ultimate root cause is that your business strategy is using code without paying for it. No such thing as a free lunch, you will pay for it, among other things, with an increased cybersecurity risk.