npm and pip is a dumpster fire for IT production environment security. The out-of-band ecosystems evolved to sidestep bureaucratic processes in favor of rapid r

npm and pip is a dumpster fire for IT production environment security. The out-of-band ecosystems evolved to sidestep bureaucratic processes in favor of rapid release versioning. Anyone who understands the auditing role and provable chain of accountability FOSS OS packagers volunteer for... knows why it was necessary. Malware will always show up, but it is arguably more important to be able to hold sources accountable. =)