The problem is that those fame-chaser maintainers aren't the only ones doing it. Babel does it. Webpack does. ESLint does it. Before them others did.
If we ban those, we'd have to ban Babel and Webpack too... Oh now, wait a minute, now that actually sounds interesting...
Re:NPM Vulnerability Discussion on Twitter
by thatwasunusual on Wednesday May 11, 2022 @10:00AM
(#31340047)
Wow. You must be a special kind of stupid?
What if we focused on fixing all the problems, and not just retreating thinking that "we can't solve this problem, because there are so many other problems related to it"?
Your thinking is literally the definition of the problem.
IMO, that's even worse, because that means that a lot of people are using stupid and vulnerable packages without knowing it.
I wish there was some sort of better control over the NPM directory, where someone could block/downvote (or whatever) packages that doesn't deserve to live. How this would - or should - work in practice, I have no idea, but it's just getting scarier by the day to import a package in your application.