> nixpkgs packages pretty much everything I need.

Yeah, because they allow anyone to contribute with little oversight. As Lance Vick wrote[1], "Nixpkgs is the NPM of Linux." And Solène Rapenne wrote[2], "It is quite easy to get nixpkgs commit access, a supply chain attack would be easy to achieve in my opinion: there are so many commits done that it is impossible for a trustable group to review everything, and there are too many contributors to be sure they are all trustable."

[1] https://news.ycombinator.com/item?id=34105784

[2] https://web.archive.org/web/20240429013622/https://dataswamp...