But "vetting" is still relying on the free labor of other and really doesn't change the business model and rectify the underlying problem with open source. You

But "vetting" is still relying on the free labor of other and really doesn't change the business model and rectify the underlying problem with open source. You really need an organization which sponsors and directly hires coders that are maintaining critical infrastructure. (Of course the npm world is a bit insane where stuff as trivial as leftpad can be critical infrastructure. Don't really think someone needs a $200k/yr salary to maintain just that) There's an interesting bit of social psychology here where the top reaction to this isn't "lets try to sort out how to pay all the people who are doing all the free work" (and I'm really thinking more the log4j and openssl people and the whole broader ecosystem problem this highlights) and instead it is "how do we keep being exploitative and just outsource the hard job of vetting everything?" I'm pretty sure Google will probably get some AI people onto the problem though, there's clearly a business model there.