TLDR Tech / Dev
If It Quacks Like a Package Manager
Any tool with transitive dependencies, where A depends on B, which depends on C, has effectively become a package manager, whether it calls itself one or not. GitHub Actions, Ansible Galaxy, Terraform modules, and Helm have all crossed this line and inherited the full set of supply chain problems, such as mutable tags, no lockfiles, and unverified transitive deps.
Read the full story