Somehow people in the ESlint thread were defending the fact that NPM seems totally uninterested in this. Yes, it doesn't solve all the problems and yes you sti

Somehow people in the ESlint thread were defending the fact that NPM seems totally uninterested in this. Yes, it doesn't solve all the problems and yes you still have to determine who to trust, but at least it makes it POSSIBLE to trust anything. Currently it's impossible to trust anything that you install—and packages can run arbitrary, unsandboxed code with access to the full filesystem when they are installed. That just seems insane to me.