Perhaps you should reflect why you are pushing adware to YOUR users then. Maybe you should vet YOUR work more carefully instead of pulling in hundreds of dependencies that YOU haven't bothered to vet.
Yes, more visibility into which packages are published/controlled by malware authors helps with vetting (immediate pass instead of reading thousands of lines of code). Yet some people are terrified by that prospect. Really makes you wonder.
"i dont even want to bother reading the code i ship to my users"