How Deep Does Your Dependency Tree Go? An Empirical Study of Dependency Amplification Across 10 Package Ecosystems · HackerPapers discussionshttps://hackerpaper.kaipfister.de/p/2512.14739/Collected HN comments and submissions linking this paper.enMon, 02 Nov 2026 11:16:22 GMTHow Deep Does Your Dependency Tree Go? An Empirical Study of Dependency Amplification Across 10 Package Ecosystems — mentioned by acdhahttps://news.ycombinator.com/item?id=49185709urn:hackerpapers:mention:2512.14739:49185709Wed, 05 Aug 2026 17:07:08 GMT<p>Nobody is saying NPM is unique - it’s one end of a spectrum but that doesn’t mean everything else is completely on the other end - for example, this study found Maven projects having almost as many dependencies on average as NPM, both well ahead of everything else: https://arxiv.org/html/2512.14739v1 Again, this is about culture rather than some innate flaw. Dependencies are about trust and I suspect that future developers are going to be amazed at how casually people ran code from strangers, similar to how stories about unprotected 70s swinger parties sound incredibly reckless to almost…</p><p><a href="https://hackerpaper.kaipfister.de/p/2512.14739/">Paper and discussion history</a>. A mention is not an endorsement.</p>cs.SE