No, my thoughts are that we need better mechanisms to validate our dependencies. So far I believe that Maven and NPM have failed to deliver on that front. The

No, my thoughts are that we need better mechanisms to validate our dependencies. So far I believe that Maven and NPM have failed to deliver on that front. The dependencies being resolved from the code store provides a decent mechanism to resolve that issue. But as long as it's being done on closed software, it's going to be hard to move towards a standard.