You're over dramatizing. For one instance of the Guava/Hadoop incident (which could happen just the same in any env), there are millions of builds that are hap

You're over dramatizing. For one instance of the Guava/Hadoop incident (which could happen just the same in any env), there are millions of builds that are happening every day that work just fine with the JVM + Maven Central repo combination. And as opposed to the Javascript repos, you cannot delete anything on a Maven repo once it's been uploaded there.