That seems intuitive. I agree in the sense that smaller supply chain surface area is easier to secure/verify. But it also makes the developers/maintainers of

That seems intuitive. I agree in the sense that smaller supply chain surface area is easier to secure/verify. But it also makes the developers/maintainers of the few packages much brighter targets. I’m more of a fan of standardizing how libraries can be rated, evaluated, trusted, marketed, etc. we need more efforts analogous to Consumer Reports / Underwriters Laboratories. So far there are a few for-profit companies in this space, including Google.