It's often the case with software "repositories". Pypi, npm, Maven... Security is expensive. An organisation needs money, on-staff security professionals, and

It's often the case with software "repositories". Pypi, npm, Maven... Security is expensive. An organisation needs money, on-staff security professionals, and (of course) lawyers to explicitly commit to maintaining a package system. Even MAAMAN (was FAANG) app stores have been exploited. FYI your second link is broken or dead.