Have been seeing these rants since the incident. Yet no concrete suggestions. Just high level hand wavy stuff like "better package management". What does that mean? We already have mandatory 2 factor, private npm registries.

Ultimately the reason the ecosystem is so fragile is because a ton of packages are maintained by solo devs. So it only takes one hack to impact a ton of code bases.

The only thing I can think of to prevent this is automated LLM scanning of every npm package when any dependency or subdependency (and that's its own gnarly tree) is updated.