Of course this is a problem for all package repositories. Ruby, Python, Docker, Node, etc. But Node seems especially bad. Why? It seems to me that Node packages

Of course this is a problem for all package repositories. Ruby, Python, Docker, Node, etc. But Node seems especially bad. Why? It seems to me that Node packages are mostly the work of a single person, and lack a community around them. You know you can trust Nokogiri because there are many developers working on it, and they're visible and accessible on Twitter et al. But many Node modules are just one person's passion project and/or resume padder. It's too easy for someone to have their npm publish keys stolen and not notice, whereas if there were more people on the project someone would probably notice sooner.