I challenge someone to tell me the difference between npm and an RCE. "npm" is two things in this picture: the server and centralized service, and the software

I challenge someone to tell me the difference between npm and an RCE. "npm" is two things in this picture: the server and centralized service, and the software tool on everyone's build/dev machines. Folks have historically been happy trusting the centralized npm server to behave consistently and pleasantly, and some opinions have recently shifted on that. But frankly, the server doesn't matter, in the big picture. The npm tool on your computer does. It's the one executing code on your computer with all of your local user's privileges. This tool starts executing new code from a new author on my host as my user without any authentication except "trust the server". This is exactly the same words we would use to describe behavior of $script_kiddie_virus_of_the_week: > "download code from C&C server; run it, thanks:D" What's the difference here? "good intentions"? I'd rather have something more than "good intentions" controlling what code ends up running on my computer. Wouldn't you?