We're so close to a full circle moment. Next up is "npm stable", a curated set of packages (a "distribution", say) known to work well that are supported for a couple of years with security patches.

A curated list of stable packages won't accomplish anything. A compromised package can just as easily be published as a security update.

Atleast now they have a wide variety of Pixar movies to choose characters from