3ooo words and it's all about neu-packages and the methods through which they're all rife with supply-chain attacks anyway. Not a proper packaging or secure delivery and distribution model in sight.

The ask

That's how I know this guy isn't serious, and may not recognize proper packaging if it cut him off in traffic.

When app people try to be OS people, it's a bad day. Enough of your cargo, your composer, and definitely enough NPM. No more pips. No more cpans. Deliver your shit properly - validation and caching is already established, if you do it right, and probably BitTorrent distro too - and just forget this paper ever existed.

This is a fucking solved problem. Just the Lost Boys werent paying attention before the mentors were gone.