Securing a dependency management system like npm, pip, et al is not a solved problem by any stretch. This isn't about the competency of any particular individua

Securing a dependency management system like npm, pip, et al is not a solved problem by any stretch. This isn't about the competency of any particular individuals, but the willingness of the software engineering community as a whole to always trade security for speed (of development, of shipping, etc).