There's a few different threat models, and different mitigations. We have attackers who: a) Want to run code on package installation b) Want to run code on a

There's a few different threat models, and different mitigations. We have attackers who: a) Want to run code on package installation b) Want to run code on application execution Restricting packages on installation helps with (a) I disagree that developers are not attractive targets. If I were to target a typical tech company I would absolutely go for a developer. I'd wait for them to SSH to production, hijack their connection, and start moving around. That's a hell of a lot better than if I attack HR and have to start moving laterally in a corporate environment to escalate. As for backdooring production services or applications, ala (b), it's a more complex and bespoke problem to solve I think. I think package managers themselves are not suited to solve this problem and it is up to the OS to restrict programs more by default, like mobile OS's/ Browsers do.