Ah yes, only `npm` has ever suffered an attack. Ever. RubyGems: https://www.sonatype.com/blog/anatomy-of-the-rubygems-rest-client-hack-and-getting-creative-abo

Ah yes, only `npm` has ever suffered an attack. Ever. RubyGems: https://www.sonatype.com/blog/anatomy-of-the-rubygems-rest-client-hack-and-getting-creative-about-open-source-security https://www.sonatype.com/blog/anatomy-of-the-rubygems-rest-c... PyPi: literally the latest attack included publishing malicious packages on PyPi XZ Tools, a part of nearly every Linux distribution nearly merged in code to backdoor SSH: https://www.akamai.com/blog/security-research/critical-linux-backdoor-xz-utils-discovered-what-to-know https://www.akamai.com/blog/security-research/critical-linux... It is just easy pickings to blame npm specifically. Yes, while they do share some part of the blame, no package manager is immune from attack and certainly not ones where the attackers exploited being able to extract out secrets from a developer's environment variables or files. Seems more like developers should be managing their secrets better? I also find that using the meme that this title snowclones is in bad taste too.