@thomasfuchs FWIW, I did a quick scan of Ruby and JS projects on my machine (mix of client work, personal projects, student projects, and OSS stuff I have locally cloned) and got a line count of the lock files (which is a rough proxy for # of dependencies).
Ruby was mean 72, median 37, max 671. (Rails apps tend to be in the low hundreds.)
JS was mean 7435, median 4743, max 30225 (!!).
Preposterously unscientific sample here, but…eyebrow-raising nonetheless.