Every time I try to get a npm based project running (or one of my forks of one), half the packages don't exist anymore or I need to spend hours fixing breaking changes.

It's usually more straightforward to just rebuild it from scratch — not to mention infinitely more satisfying — and that was true before AI!

Yes it does depend on the dependency, and a static asset is on one end of the extreme.

It depends on the "load bearing" code. Obviously something like crypto is not something we should implement ourselves but core business logic would be "load bearing" in another way and is probably not something you want to farm out to a dependency.