What are you suggesting here? That npm Inc (basically Microsoft), Python Software Foundation, Ruby community, PHP community, Rust community, Go community raise

What are you suggesting here? That npm Inc (basically Microsoft), Python Software Foundation, Ruby community, PHP community, Rust community, Go community raise funds to hire people to individually vet each and every change in each and every package? OK, let's do that because we have SO MANY excess jobless developers. /s OR we could use MUCH less resources and just make a sanction list.