I personally believe this is going to be the biggest security nightmare of the next ten years. All those npm/gem/pip/deb packages that are imported by thousands

I personally believe this is going to be the biggest security nightmare of the next ten years. All those npm/gem/pip/deb packages that are imported by thousands of projects and Docker images, with maintainers who are retiring. So easy for a malicious actor to just slip in some code, and who has time to audit all those dependencies for every single update?