[oblio]

Package managers include npm, bundler, maven, gradle, cargo, etc, not just distro ones.

[adriancr]

and those package managers need to have security built into them as well.