I fail to see how controlled builds would have prevented Marak pushing a patch release that broke everyone. Most malicious package activity I've seen has been

I fail to see how controlled builds would have prevented Marak pushing a patch release that broke everyone. Most malicious package activity I've seen has been at the hands of the original maintainers to begin with. The last thing can't be solved technologically.