> [..] there's viability in a service offering access to pre-audited repos like NPM, basically just a curated proxy with a process around certifying the securit

> [..] there's viability in a service offering access to pre-audited repos like NPM, basically just a curated proxy with a process around certifying the security of packages and updates into the repo, [..] This exists and is not uncommon in the enterprise world. sonatype is an example I have worked with in my Java days and I think they over npm too nowadays. It's just expensive and therefore not ubiquitous.