The problem is that if you import 1000 packages by 500 different authors, you must trust 500 authors. You must trust them not only to not be malicious, but not

The problem is that if you import 1000 packages by 500 different authors, you must trust 500 authors. You must trust them not only to not be malicious, but not to have been compromised. How can there be an automated solution to this problem? The only solution is to develop some discipline around dependencies. Unfortunately the current culture around Node/NPM has gone in the opposite direction.