Well I think the main important argument here is you shouldn't use the package management. A third party package manager would be even more concerning to use imo. I generally try to stay away from the typescript world so unfamiliar with nuances of NPM.

Sure. And people shouldn't steal people's credentials and publish malicious artifacts, yet here we are.

Just because you expect people to behave like X doesn't mean they will. In this case people will automate packaging of artifacts.

NPM was a third party manager (it's not part of EcmaScript nor was it part of Node.js at start) and so is Maven. Reputation matters more than origin.

Those who do not know history are doomed to rediscover it.

yep which people have already done in odin