Node.js packages don't deserve trust
TL;DR: There's nothing fundamentally less worthy of trust about node's supply chain than any other popular mainstream language ecosystem. They've all got some badness.---Here's a trope I'm tired of:Take X general problem that affects a wide range of systems, attribute it to one narrow system Y. Usually because that system Y's general accessibility and success leads to a higher number of high profile incidents related to problem X.One of the practical outcomes of this trope is people trying to solve this problem in narrow, ecosystem-specific, non-portable ways.