Can anyone using the NPM ecosystem actually control their supply chain? Personally, I feel that anyone using JavaScript doesn’t care about such things. Because they can’t. Or has the landscape changed?
And then if you install a malicious package that phones home, you might get an alert.
Of course this doesn't guarantee anything, as the package might activate the malicious behavior only under some specific circumstances. But it also doesn't cost anything. So it's a small win in my book.
Here's how it works in practice:
https://askubuntu.com/questions/1145649/apt-strange-requests...
--note this part in the accepted answer:
> they are surprised that more people hadn't noticed the behavior in the past.