That has nothing to do with how granular packages are. The npm is broken as it allows such things. Look at this spectacular example of providing high security for users: https://www.npmjs.com/package/kik
Someone has to do this manually?! If the package is not popular, no one cares? What happens if I send them an email and provide the same package with the same API (not trademarked and MIT licensed) but break it a bit on every update?
when those packages are not under your control, it has everything to do with how granular they are and by extension how many you depend on and thus have to trust/verify.
when was the last time you rechecked the entire source of a package you depend on after updating it?
