[trashburger]

>#2 is endemic to all package managers.

It is endemic to package managers which don't do curation, which is why I'm a fan of package managers that do.

[maxbond]

Sure. Really I meant "language community package registries," which are necessarily open bazaars from which more selective repositories can be drawn.