Sure but you cannot build something serious without guarantees. Maybe you can set a flag in your package.json which enables only the usage of packages from aut

Sure but you cannot build something serious without guarantees. Maybe you can set a flag in your package.json which enables only the usage of packages from authors that have agreed.