Using a package manager like npm does not prevent having a separate team of people responsible for validating and re-publishing packages under their own namespa

Using a package manager like npm does not prevent having a separate team of people responsible for validating and re-publishing packages under their own namespace. A new organization could step in and make their own whitelist at any time.