Ideally everything not built specifically for any given project is part of the OS or some other battle tested, supported system package.

For example, I might well choose to reimplement eg a subset of TOML parsing to avoid the dependency risk.

I don’t write JavaScript/TypeScript, but if I did, I’d find Bun’s “batteries included” approach compelling, at least to the extent I decide I can trust Bun, after due diligence