Why not logback instead? It's existed for more than 10 years and its stated goal is "picking up where log4j 1.x leaves off"

http://logback.qos.ch/

Just leads to the xkcd “there are now 14 competing standards.”

Honestly the biggest problem of package managers is finding a reputable package that one can trust.

The best one can do to aid this situation is reviewing, vetting and warning of which packages that can be trusted and not. Automatic scanners to find code smells and vulnerabilities.

“Security rating: 2/10, This package seems to use JNDI loading, are you sure you want to continue (y/n).”

Humor me: if log4j had 13 (independently developed) competitors, wouldn't the impact of this be much lower, because many consumers would use different libraries? Like genetic diversity as a hedge against disease.

Joke's on you: Then any nontrivial project would end up depending on half of them, actually increasing attack surface.

I bet they'd all compete on features and probably implement the same exploit trying to maintain market share.

Logging as it's understood today should ship with most STD libraries. Things like logback an log4j really should just eventually be rolled into the std.