I agree. To be more specific I think the problem with npm is that it explicitly trusts names and implicitly trusts their referents, which puts too heavy a burd

I agree. To be more specific I think the problem with npm is that it explicitly trusts names and implicitly trusts their referents, which puts too heavy a burden on the name resolver. Contrast this with apt, which inspects package signatures and compares them to keys I've trusted. If a package shows up with the same name as before, but different bits, and it's signed by somebody new, I have a reason to scrutinize it more heavily.