„Apart from a clean history...“ is a pretty strong caveat. Our times are seeing a breakdown of trust. News media, companies, and politicians are considered cor

„Apart from a clean history...“ is a pretty strong caveat. Our times are seeing a breakdown of trust. News media, companies, and politicians are considered corrupt by default. Yet trust is the single most important ingredient to organize a complex society. Those advocating to “trust no one” always have complex theories on how some organization’s incentives are corrupting them: “they only want to print the news that benefit their advertisers” etc. But such accusations are easy to make and essentially impossible to prove if you just discount the evidence that is historic behavior. Scientists are also just “in it for the money” even when they have tenure (global warming), charities “have their own motives to exaggerate”, and so on. If NPM turns to the dark side, the impact on any individual user of their repository is likely to be minimal, and barriers to switching to some other repo are minimal. So at least from the users’ perspective, the downside of extending them a bit of trust seems to be limited.