> you've basically said no developers should ever trust npm Nobody should. At least not blindly. You should check what updates are and who made them. On every

> you've basically said no developers should ever trust npm Nobody should. At least not blindly. You should check what updates are and who made them. On every update. Anything else is irresponsible and your own god damn fault when things go wrong. > That is not how open source works. npm is a proprietary package-repo and has nothing to do with how open source works. You can also easily publish proprietary packages using npm.