Good point, however unlike Apple's model, if a hypothetical certified NPM repository was set up, there is still the open public repository. The freeform and exp

Good point, however unlike Apple's model, if a hypothetical certified NPM repository was set up, there is still the open public repository. The freeform and experimental problem solving still occurs there. Developers could even benefit by being able to add the certified stamp to their public repositories if they so wished. From the user's POV, opting to use the certified package repo would be a conscious decision and the trade-offs vs benefits should be well advertised. The service could also offer a "self certified" package facility to users if they understand the risks. Now that I think about the potential downsides, would developers eschew dependencies to reduce the risk of losing a coveted "certified" badge, thereby undermining one of the more useful aspects of nodejs? Would developers get upset their code is included in a paid service and demand takedown or a revenue share? Fast forward a bunch of years, does this certification service become a looming spectre hovering over the node ecosystem and end up hurting what it was supposed to protect? Is the risk of a zero-day making it into the "official" repository too big for a startup to handle? Is it too much to ask users to simply "trust the process"? Would it just be too annoying for in-house developers to constantly have to battle missing and outdated dependencies as the certification team struggles to keep up with the constant stream of updates and new packages? It would definitely require a lot of resources to set up and maintain, not to mention financial and legal finesse. Maybe this is why I haven't come across such a service yet, maybe it's just in the too-hard basket or something. Interesting to think about though.