"Dependency managers can often provide statistics about usage" Using module usage statistics as a proxy for trust is not always a good idea. For example, I co

"Dependency managers can often provide statistics about usage" Using module usage statistics as a proxy for trust is not always a good idea. For example, I confirmed with the security team of npm that they do not audit module download statistics, i.e. no detection of gaming the system through multiple downloads from a given IP. It's quite possible for a module to have 10,000 weekly downloads, all generated by a cron curl script run by the module's author. I wouldn't be surprised if this was the case for not a few modules on npm, especially to develop trust for later exploits.