Great article. Some thoughts (mostly informed from design of Buckaroo https://github.com/LoopPerfect/buckaroo/ https://github.com/LoopPerfect/buckaroo/ ): - C

Great article. Some thoughts (mostly informed from design of Buckaroo https://github.com/LoopPerfect/buckaroo/ https://github.com/LoopPerfect/buckaroo/ ): - Cost of creating a package must be low (ideally the package just lives in source control). This encourages code reuse and therefore testing. - Verification of changes must be easy. Git is a great tool for this - we can review patches between versions, rather than whole versions at once. - It should be easy to extract dependency graph (including transitive deps) so that you analyze who you are trusting. - There must be a verifiable chain from package source to package bundle (NPM fails here, do you really know the source code reviewed on GitHub is what went into the bundle on the NPM registry)? Better yet, have no bundles at all, just source code + build instructions. - Reproducible installations (usually implemented via lock-files) are critical. Many package managers have lock-files that do not actually give reproducible installs. Beware! - Package builds must be isolated from each-other (otherwise one package might tamper with another; I believe this is possible in NPM packages)