The ability to audit the code. If not that, the ability to trust the reputation of the author which creates an incentive not to willingly insert a backdoor. Y

The ability to audit the code. If not that, the ability to trust the reputation of the author which creates an incentive not to willingly insert a backdoor. Yes, `npm install` was always bullshit because most people didn't bother to check, which is exactly why it was exploited multiple times, which created a conversation about "supply chain security". If you want to argue that "npm changed the world" then you are correct. It did not change the world for the better though.