Many people here say that slowing down is a must -- and I agree it's probably the best solution -- but surely there are more approaches we could think of: * No

Many people here say that slowing down is a must -- and I agree it's probably the best solution -- but surely there are more approaches we could think of: * Not allowing packages with similar names to popular ones * Not allowing packages creation to be anonymous (in the extreme case you would require to validate your passport or similar) * Automatic detection of malicious code * Central auditing organization ... This is just on top of my head, there must be many more ideas.