Both of those have over >400 dependencies each [0] [1] but just in Rust instead - there hasn't been a Rust supply chain attack yet but is this any better? [2]

Both of those have over >400 dependencies each [0] [1] but just in Rust instead - there hasn't been a Rust supply chain attack yet but is this any better? [2] Admittedly you're not normally downloading the dependencies to your machine as you're often using pre-built binaries, but a malicious package could still run if a version was shipped with it. [0]: https://github.com/biomejs/biome/blob/93182ea8e9d479fd0187ce21ff8fdcdf143d64cf/Cargo.lock https://github.com/biomejs/biome/blob/93182ea8e9d479fd0187ce... [1]: https://github.com/oxc-project/oxc/blob/65bd5584bfce0c7da90ff46f8e1052861e14b7eb/Cargo.lock https://github.com/oxc-project/oxc/blob/65bd5584bfce0c7da90f... [2]: https://users.rust-lang.org/t/yet-another-npm-supply-chain-attack-is-cargo-any-safer/133766 https://users.rust-lang.org/t/yet-another-npm-supply-chain-a...