Who does open source actually depend on? I scanned the 433 most-starred JS repos

Two years ago the xz backdoor reminded everyone that "the ecosystem" is often one tired person. I...