> why would this be any more dangerous than downloading and installing from a a package manager? Normally the packager and developer are different people so th

> why would this be any more dangerous than downloading and installing from a a package manager? Normally the packager and developer are different people so there is a second set of eyes to at least give a cursory glance to the changes. It takes more than a single compromised account to publish malicious changes. There are of course a million exceptions and caveats to this and it's not perfect, but it's better than allowing developers to push code directly.