[zer00eyz]

I spend most of my time writing go (among other languages).

Candidly its decentralized nature when it comes to "packages" is one of its strengths. It does have downsides, and yes GitHub could be at issue at some point.

After this, after NPM compromises (left pad and more recently the supply chain attacks) why we arent seeing more community driven changes around decentralization and venturing is beyond me.

[madeofpalk]

I don't think anything about the NPM supply chain attacks has to do with it being centralised. If anything, it made it easier to heal as NPM could centrally remove the bad packages.