It seems insane to me that devs are just blindly installing packages all day (some of which are installing their own packages/dependencies).

It's a huge tree of dependencies, and nobody's checking for malicious software in there? 🤔