> do you think there is a market for vetted/audited/curated mirrors of the major language package registries I personally wouldn't see much value in it, but it

> do you think there is a market for vetted/audited/curated mirrors of the major language package registries I personally wouldn't see much value in it, but it wouldn't surprise me if there was a market for it since it would be a good way for large companies to claim they're being responsible without doing anything but spending a (relatively) small amount of money. The reason I don't think there's a lot of value in it is because having something curated or audited by anyone that isn't an expert in the niche isn't going to super effective, is it? Maybe they can pick out obviously malicious code and there are some easy wins at the start, but I think bad actors would adapt and do a better job of obfuscating malicious code.