FOSS supply chain... so many people using that project, not contributing squat, not security reviews, not anything... just bring it in as a magic dependency for $0.

Good and valid question.

The former implies single entity responsibly, while the latter is more like an ecosystem problem. So which is it?