I think this is interesting story on many fronts from both an ethical front as well as systems to communicate better exactly what packages are being used. Righ

I think this is interesting story on many fronts from both an ethical front as well as systems to communicate better exactly what packages are being used. Right now, many packages are deeply dependent on other packages. If at a wrong time, things could break, and worst, timed correctly, malicious code in at some random interval that may go uncaught. What is the correct direction we need to head as developers and the toolings needed? This is not from perspective of just the maintainers, but this makes the point that breaches and unauthorized pushes could happen.