Any community dependent on a particular repo is at risk. I'd argue that RubyGems is just as risky as NPM, for example. The problem is that there's no good fix

Any community dependent on a particular repo is at risk. I'd argue that RubyGems is just as risky as NPM, for example. The problem is that there's no good fix or alternative, it's hard to avoid a single point of failure.