I think it’s more realistic to keep the current system where you download packages and updates from npm. The issue is rare, not every package is that popular an

I think it’s more realistic to keep the current system where you download packages and updates from npm. The issue is rare, not every package is that popular and destroyed by their author, and it has been fixed quickly. Forking is easy but maintaining a fork, including security updates in a short time, is a lot of work and I doubt many developers would actually do it.