The problem is that people prefer adding a shebang regex dependency, rather than just copy the regex into their codebase.

If your dependency is less than 10 lines of code, you shouldn't depend on it. You can just copy those 10 lines of code.