Linux distros and Mobile Apps rarely see these issues for one simple reason: packages must all be signed by a vetted maintainer before they are ever submitted a

Linux distros and Mobile Apps rarely see these issues for one simple reason: packages must all be signed by a vetted maintainer before they are ever submitted and every client has the ability to verify signatures came from approved maintainers who hold the signing keys. Phishing, bad 2FA, and vulnerabilities of the central repo upload path itself all go away with this simple tactic used by all sane package managers. Someone PRed this exact same effective strategy to NPM in 2013, and it was refused even as -optional-. https://github.com/npm/npm/pull/4016#issuecomment-76316744 https://github.com/npm/npm/pull/4016#issuecomment-76316744 NPM team members have ignorantly maintained that hashing packages is good enough. They insist on being a central authority for all packages with no method to strongly authenticate authors and this negligence has repeatedly endangered millions. Meanwhile Debian and other community Linux distros maintain, sign, and distribute hundreds of popular NodeJS packages themselves now because they realize it would be negligent to risk having NPM in their supply chain.