My first thought yesterday was that I really cannot trust NPM anymore because if someone sneaks in an anti Russian piece of code somebody else could sneak in co

My first thought yesterday was that I really cannot trust NPM anymore because if someone sneaks in an anti Russian piece of code somebody else could sneak in code against any other country, or look at the content of files to get an idea of the kind of person running the code and decide what to do. People voting for the other party, thinking something different, etc. And why not Python, or Java, Ruby, anything. Maybe we'll all end up running Tails. Edit: if something like that happens, how long before certifications require that no unvetted code is used in projects or no open source at all?