That's beyond ridiculous, as an ecosystem. There is zero means for a user of npm to audit packages end-to-end.

Is anyone attempting to improve upon this poisoned web of packages?