This is important. It looks like the organization is submerging; they've deleted their NPM account and the package and emptied their GitHub repo.
This should be signal boosted as hard as it can be managed, because this is rough stuff.
This should be signal boosted as hard as it can be managed, because this is rough stuff.
And yes, I get the irony of adding another dependency to help with the security mess caused by the node ecosystem's bent towards external untrusted / unverified dependencies.
I wouldn't doubt that there are package names that would collide because of such a change, but that's probably a good thing.
Does npm normalize package names with unicode in them? Would "сrοѕѕ-еnν" be considered equivalent? (Although this would only work if users copy/paste the name).