> it downloaded literally hundreds of random dependencies, there was no way I could verify the security of it.

You just described any modern shitware that uses npm.