The event-stream incident shows that npm has restructured the way projects work: rather than an end-user choosing a few pieces of software, each of which has a lot of maintainers, they install a huge number of very small packages each of which has a very small number of contributors. The "unit of contribution" is not a pull request or commit but spawning a new micro-project.

Community management and vetting remain hard problems that aren't fun to volunteer to work on for many developers, so they are neglected.