> I wouldn't really say thatWe can agree to disagree, but pretty much every modern app uses dependencies at some level, and that's a problem for everyone. Sure, npm is probably the worst of them all, but even the so called "safe" Rust is very heavy on dependencies - just look at any popular Rust project these days. It's only a matter of time until a malicious or poor quality code makes its way in a popular Rust project... or any other project for that matter. Just see the state all the popular FOSS projects are in, they're all getting swamped by LLM-driven PRs, so much so that some projects (like Ladybird) have decided to stop accepting PRs completely.
The problem isn't just about whether or not the code is accurately reviewed, because under pressure, humans are bound to slip up - just take a look at what happened with the XZ project, it has now become a textbook example of how projects can be compromised. LLMs have made the situation worse, it's only a matter of time until we see a second or third Jia Tan due to the pressure maintainers are in - or we see more FOSS projects stop accepting PRs altogether.
In such a scenario, every dependency is a liability.
And if you ignore the OS, that means you're drawing an arbitrary line in the sand - because how would you define what consists of an "OS"?
Going back to our example app, what if the app's dependency is Qt, and if Qt has vibe-coded components - by your original definition a few comments ago, that would make your app not human-made. But many distros also include Qt components OOTB due to some dependency or other (eg for KDE), so that would mean the OS is also not 100% human-made right?