Almost all npm packages are open and the code available in Github - so if npm package maintainers are not being policed then it's the community's fault for leec

Almost all npm packages are open and the code available in Github - so if npm package maintainers are not being policed then it's the community's fault for leeching and not looking into the code. I run an install script for my package [0], this install script forces 2 lines in users' .gitignore files to prevent EXTREMELY sensitive data being committed into a public repo - despite me telling everyone in the community to not commit these files on god-knows how many occasions. I do this because I care about my users and I know if I tried some funny business then they would rightly call me out for it - NOT "because I'm allowed to". [0] - https://github.com/open-wa/wa-automate-nodejs/blob/0ba7d685066956949a6543e194d85845f8361649/package.json#L31 https://github.com/open-wa/wa-automate-nodejs/blob/0ba7d6850...