The big problem is not bugs, not vulnerabilities, but malicious code inserted deliberately into packages published by attackers. One way to detect malicious co

The big problem is not bugs, not vulnerabilities, but malicious code inserted deliberately into packages published by attackers. One way to detect malicious code is line-by-line code review of published packages, but that's extremely laborious, even when done by third parties. What we really want to do is confirm that the package was the end product of an open source commit history, where commits were reviewed by a set of trusted authors (hey look third parties!) over time. That involves strong validation of publisher identities and cryptographic validation of the package contents to connect it to a commit history in a trusted public repository.