And what kind of automated dynamic analysis of popular dependencies do you expect to meet? And who will analyze its report and prevent the malicious package to

And what kind of automated dynamic analysis of popular dependencies do you expect to meet? And who will analyze its report and prevent the malicious package to be uploaded to the repo?