I know, but the reputation part doesnt solve the hacked part, hence my comment:)
As nostr:npub1zxu639qym0esxnn7rzrt48wycmfhdu3e5yvzwx7ja3t84zyc2r8qz8cx2y mentioned zapstore is much better implementation of this because its higher up in the food chain, here you have layers so maybe the author of the lib you are using has high rep score with the author of the lib that his lib was using but not with you, the problem is that a tiny lib is not a finalized product so you can have multiple layers of reputation/trust in between, its not very informative at the point
Did someone jack the devs' keys? Or was it someone playing a long game (where reputation may help more)?
Do it for agents! That's where we have j curve potential. New app store is cool and I'm a huge fan of nostr:npub1wf4pufsucer5va8g9p0rj5dnhvfeh6d8w0g6eayaep5dhps6rsgs43dgh9 & nostr:npub10r8xl2njyepcw2zwv3a6dyufj4e4ajx86hz6v4ehu4gnpupxxp7stjt2p8, but building for agents has way more mainstream potential imo
The initial step of this recent wave of npm hacks started with Qix being hacled, then another dev so it was not a long term infiltration like the xz utils attack last year https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
The agent marketplace is indeed interesting.
I don't see how it would fix the npm problem though, I second what aljaz and Justin said.
