Yeah, a bit of hyberbole, but I think my point is it's been proven to be relatively simple, or at least simple in theory. I think npm could improve security wi

Yeah, a bit of hyberbole, but I think my point is it's been proven to be relatively simple, or at least simple in theory. I think npm could improve security with two steps: 1) all packages must be user-or-organization/package-name, and 2) all packages need to be signed with a key. Have namespaced-by-default packages at least will give a path for developers to trust an author or source. Signed packages would give developers the means to trust a key. All systems that allow public packages to be published are going to have inherit security flaws, and the best security I think we can give is trust. It's easy to invalidate a key, and it's easy to flag a namespace as untrustworthy. While there is no "dependence" on npm, most package managers ship node with npm, and the typical flow for a node app, according to most tutorials and community documentation, is to use npm. Even most of the tools a developer would use with node are npm-centric (documentation almost never recommends cloning the repository, just npm install). So I'd agree, decoupled in reality, but is perceived as reality among tutorials and the community.