For this particular case obviously previous packages didn't show it clearly enough. And yes, if you give thousands of 3rd party devs (or anybody snatching their credentials) direct access to your build machines or production systems, you should absolutely expect some of them to be unstable in all kinds of ways.
Insider problem is hard enough to guard against when you know the people involved.
That justifies using something like rollup or webpack to bundle all your dependencies into one huge file to make a "static build" of sorts. Then you can at least do a cursory check for anything obviously bad in the changes, if tree-shaking works well enough.
It leaves vulnerabilities open until next release, but deals with direct attacks.
Boilerplate is only easier to read and analyze if you can be sure it is consistent, so you can tune it out. Usually though, there is this one getter method that is not quite like the others and you literally will not see the difference until it bites you.
We'll need more IDE enhancements, to highlight interesting pieces and desaturate standard boilerplate...
We used to catch them by the wing by slowly approaching. Interestingly, medium ones were easy, but the big ones (different species, much rarer) wouldn't let me approach at all.
For this particular case obviously previous packages didn't show it clearly enough. And yes, if you give thousands of 3rd party devs (or anybody snatching their credentials) direct access to your build machines or production systems, you should absolutely expect some of them to be unstable in all kinds of ways.
Insider problem is hard enough to guard against when you know the people involved.