This. I ducked out of an open security-related NPM RFC and decided my efforts are better spent recommending alternative package managers, because the maintainer

This. I ducked out of an open security-related NPM RFC and decided my efforts are better spent recommending alternative package managers, because the maintainers/proposal advocates were exceedingly disinterested in addressing a wide variety of edge cases with a “you shouldn’t do that” attitude. Well, yeah I agree, but people can/will/do do that. If your security solution doesn’t account for how it might be misused, it’s insecure by design. Edit: it’s the audit assertions proposal for anyone interested. I consider it so high risk that I’m actively working to move projects in my purview off NPM in case it lands.