Why can’t we solve this problem by forcing users to provide checksums? It’s particularly damning that Microsoft owns Github and Npm for their own strategic purp

Why can’t we solve this problem by forcing users to provide checksums? It’s particularly damning that Microsoft owns Github and Npm for their own strategic purposes and do nothing to mitigate the fact that source code hosted on Github can differ drastically from the compiled code in the registry.