Remember that "uutils" has between 200 and 300 dependencies, and the author said that he understood there is always a supply-chain-attack risk, ""but that's a risk we are willing to take"". There is more and more tooling around to help mitigate the risk, he said.