Devs happily threw users of their apps under the bus with various thirdparty spyware/malware included into websites or mobile apps they wrote. There's no sandb

Devs happily threw users of their apps under the bus with various thirdparty spyware/malware included into websites or mobile apps they wrote. There's no sandbox to protect the devs, though... :) So when NPM and friends will get trully weaponized in a smart way, it is going to be a real shit show. This looks like a good time to ramp up my defenses. Some kind of package review staging area would be nice. No more pulling npm packages directly from the net, but only from a local repository which only allows to pull updates into it after a manual review of changes from upstream npm packages. Or something like that.