I agree, but you have to start from a known working state at some point - and at that point you are extending trust to that specific set of versions. Anyone who

I agree, but you have to start from a known working state at some point - and at that point you are extending trust to that specific set of versions. Anyone who ran `framework create-project` for a framework that included event-stream as a dependency will have downloaded the exploit and then pinned it without knowing. Stack (https://docs.haskellstack.org/en/stable/README/ https://docs.haskellstack.org/en/stable/README/) for Haskell solves this problem by maintaining sets of curated version numbers that are known to work together.