“The fundamental problem with npm is that any package you install has full access to do whatever it wants on your computer.”
You install leftpad and hand a stranger the keys to your laptop, your servers and your users’ data. One maintainer already decided wiping drives in Russia and Belarus was fair play. Banning bad actors doesn’t scale. Packages need capabilities, not blind trust, and npm still runs everything with full access.