Reading about these npm supply chain attacks dropping AI-assisted backdoors. Founder lesson I learned the hard way: your dependencies are your attack surface. Every package you import is a trust decision. Most teams treat it like picking cereal at a grocery store.