> And crates.io prevents similar action how exactly? You're confusing a service where anyone can distribute their half-assed package with the dependencies you

> And crates.io prevents similar action how exactly? You're confusing a service where anyone can distribute their half-assed package with the dependencies you adopt for your package. It's not the job of crates.io nor npm to vend dependencies. That job is on you and on anyone who wants to consume a third-party package. It's weird how some people complain that they are not obligated to perform any form of due diligence at all on basic things like be responsible for the crap they decide to mix with their work. I mean, the protest release of the colors package was done with a very obvious and very glaring major version bump, and people just swallowed it whole without any check at all? That's a problem of your own making, not npm or crates.io.