I agree 100%. I don't happen to use npm/Node, but I'm terrified that this could happen in the language/package ecosystems that I do use. I don't think that thr

I agree 100%. I don't happen to use npm/Node, but I'm terrified that this could happen in the language/package ecosystems that I do use. I don't think that throwing wide-ranging functionality into the standard library is the answer, but I think with a bit of tooling it might be feasible to provide a "trusted" tier of packages that have been signed off on by code reviewers. Instead of every vendor needing to vet every dependency in their product, the work could be spread around. When a vendor finds they absolutely must have the functionality provided by a package in the untrusted "playground" (or whatever), they might be motivated to sponsor a review to upgrade it.