IF IT QUACKS LIKE A PACKAGE MANAGER

Summary from the TLDR Dev newsletter

Any tool with transitive dependencies, where A depends on B, which depends on C, has effectively become a package manager, whether it calls itself one or not. GitHub Actions, Ansible Galaxy, Terraform modules, and Helm have all crossed this line and inherited the full set of supply chain problems, such as mutable tags, no lockfiles, and unverified transitive deps.