Is there any project or organization that forks non-corporate packages and verifies updates? Rouge developers and hackers will continue to be a problem. If such

Is there any project or organization that forks non-corporate packages and verifies updates? Rouge developers and hackers will continue to be a problem. If such a project doesn’t exist, would you use it? And ultimately would you pay for it?