[dijit]

> Meanwhile most of us are downloading hundreds of thousands of lines of code using all kinds of package managers.

Depending of course on the Package Manager, but traditionally those are signed, usually by people who actually do inspect the code. (I used to maintain Fedora RPMs, we audited code before putting our signature on it)