Decentralized? This is a centralized package registry. There is nothing decentralized about it.

oh right, good point, I wonder when somebody will just sue NPM for any damage caused. That's really the only way we'll see change I think.