I think this could be done as a community. Imagine if npm allowed organizations to publish "vetted pointers" to packages. So redhat could publish a "{redhat}co

I think this could be done as a community. Imagine if npm allowed organizations to publish "vetted pointers" to packages. So redhat could publish a "{redhat}colors", which would include only the vetted versions. When installing, you could choose to setup your installation to allow "redhat-vetted" versions only. And that would apply even to sub-dependencies. This becomes a community tool if "redhat" could tell npm to vet anything vetted by another org.