Correction: no one should have been trusting it for years already. There's very obvious supply-chain vulnerabilities in pretty much all open source developer re

Correction: no one should have been trusting it for years already. There's very obvious supply-chain vulnerabilities in pretty much all open source developer repositories. And that's by design: npm, pypi, rubygems, cpan etc are developer resources. Nobody should have been deploying them unseen to production. Ever. If you want trust, use a (Linux) distribution as intermediary.