Comment by Havoc

Really feels like these big open packages repos need a better security solution. Or at least a core subset of carefully vetted ones.

Same issue with python, rust etc. It’s all very trust driven