It would be interesting to see graph on different authors (or people with publishing and committing rights), to see what sort of attack vector we are seeing in

It would be interesting to see graph on different authors (or people with publishing and committing rights), to see what sort of attack vector we are seeing in here. E.g. Beego there seems to rely only on astaxie's own packages (and Go packages). That was my primary take away from NPM debacle, injecting malicious code on one repository from hundreds of authors of small packackges is risk, whereas it's not as big with few dependency authors.