I think what could make the npm ecosystem more trustworthy is if there was a system to “verify” packages similar to how twitter verified accounts. Essentially a

I think what could make the npm ecosystem more trustworthy is if there was a system to “verify” packages similar to how twitter verified accounts. Essentially a package like “react-native” would have a symbol indicating that the npm corporation verified it was owned by Facebook. Perhaps the CLI could then also warn you when you install an unverified package.