Exploits can be shipped in any type of dependency. Remember the compression exploit that affected even SSH?

The problem is your solution depends on the honor-system. Ie “trust me, because I’m just a YAML mashaller. Why would I want to inject a crypto miner?”

That’s why package databases exist. They are meant to be centralised databases of peer reviewed and CVE checked resources. But Gos approach pushes all that responsibility onto each and every developer.

One thing it does get right, in my opinion, is removing the value of name squatting.