You could require that packages pass community review before they're allowed to be published on (the main) registry. Emacs-lisp (Melpa) does this. Although it's

You could require that packages pass community review before they're allowed to be published on (the main) registry. Emacs-lisp (Melpa) does this. Although it's a different thing, Homebrew does that also.