@Di4na True, you are not a supplier, but the packager of your code is. Your article conflates the dependency graph with the supply chain, which hides this distinction. Happy new year!