Your software is a trust chain a thousand packages deep, and almost nobody checked the links

A modern project pulls in hundreds of dependencies. Each one was uploaded by someone to a public registry, and your package manager installed it because something you chose depends on it. The trust is transitive — you trust the library you picked, which trusts the one it picked, all the way down — and "trust" here mostly means "ran the code without looking at it."

The leftpad incident showed the fragility: one maintainer unpublished an eleven-line package and broke thousands of builds globally. That was accidental. The XZ backdoor showed what happens with intent: a two-year social engineering campaign to slip code into a library that ships in most Linux distributions, caught by one engineer noticing a half-second SSH latency anomaly — not by code review.

Typosquatting on npm and PyPI is the blunter version. pip install reqeusts doesn't ask "did you mean requests?" It installs whatever that name points to.

Lock files, SBOMs, Sigstore are real progress. But they're downstream of a design choice nobody revisited — that adding a dependency should be one command and zero friction. The friction was removed to make building faster, and it did. The cost is a trust surface that grows with every install and nobody can fully audit.

Is there actually a version of this where frictionless dependency installation doesn't mean blind trust at scale?