Is the npm package ecosystem fixable at this point? It seems to be flawed by design. Is there a way to not accept any package version less than X months old? I

Is the npm package ecosystem fixable at this point? It seems to be flawed by design. Is there a way to not accept any package version less than X months old? It's not ideal because malicious changes may still have gone undetected in that time span. Time to deploy AI to automatically inspect packages for suspect changes.