Inadvertant bugs are the last thing I worry about in the javascript (node) ecosystem.

I'm more concerned with the fact that running anything requires transitive trust to hundreds or thousands of projects in node_modules, any of which can run scripts while being installed.

How many people out of a thousand would you trust running commands at your terminal?