the security of their packages should not depend on one laptop being compromised

You are absolutely right. The dangerous part of NPM packages is the post-install script. Therefore moving from JavaScript to Java removes the threat.

…. lol

Meh maven plugins are just as juicy a target as npm is

How would that help? These are not general purpose, base system libraries, these are libraries specific to a product that uses them. Either you're not using them and hence they would not be installed in the first place, or you're using them because you have the product installed.

Though I would expect that Insights uses RPM packages to ship components and not the public NPM packages.

It’s difficult to determine which individuals are involved and even if you manage to do that they almost certainly live in countries without extradition.

Yes, I do this. It absolutely would catch some of these.

[dead]