The analogy in npm is dependency proliferation, along with what appears to be weaker community norms around security. To the extent that either or both of these

The analogy in npm is dependency proliferation, along with what appears to be weaker community norms around security. To the extent that either or both of these are true, I think the “no way to prevent this” quip is essentially accurate.