Yarn and NPM are enablers of these issues, not solutions to them. The convenience they afford combined with the culture of the JavaScript package ecosystem need

Yarn and NPM are enablers of these issues, not solutions to them. The convenience they afford combined with the culture of the JavaScript package ecosystem needs to be entirely revisited. As it stands, we are all simply waiting for something widescale and truly serious to happen from one of these incidents. Then--and only then, it seems--will mature perspectives be called for.