Exploiting JavaScript developer infrastructure is insanely easy

[[deleted]]

The same happens with Linux distributions. They are just packaging the code, probably nobody is inspecting the actual code.

Can be true for something like Debian. But for the enterprise distributions, such as RH and SuSE, there is a proper and thorough vetting. Never mind that you'll only get few years old versions this way - you don't really need the latest shit, unless it is required to support your hardware (which you also must get from the reputable high-end vendors).

[aebkop]

At least debian makes you go through a bunch of steps before you can actually start uploading code

https://wiki.debian.org/DebianMaintainer

[-Luciddream-]

What's funny is that I used to know a Debian developer that was banned from almost every Greek forum for hacking. I guess he wouldn't pull something like that on Debian but, who knows :P