Agreed, more than time to revisit. I have stopped using npm entirely because of their cavalier attitude to security. Code signing could and should have been im

Agreed, more than time to revisit. I have stopped using npm entirely because of their cavalier attitude to security. Code signing could and should have been implemented years ago. It's not a panacea but just part of defense in depth. I can't trust npm whatsoever to do the right thing at this point.