I find your concern valid. Deno makes it easy to import from temporary places. However, this wouldn't be solved by having a centralized registry or a package m

I find your concern valid. Deno makes it easy to import from temporary places. However, this wouldn't be solved by having a centralized registry or a package manager like npm. Npm can install from git repos and registries other than npmjs. Having a package on npm by its own doesn't make it any less malicious. A solution would be to enforce registries you can import from and fail if it's outside that.