Been working on this exact thing for nearly two years at https://www.phylum.io https://www.phylum.io. We identified and reported about 1.2k packages in ecosyste

Been working on this exact thing for nearly two years at https://www.phylum.io https://www.phylum.io. We identified and reported about 1.2k packages in ecosystems like npm, pypi and others last year. GitHub app that checks your PRs for malware. We also built a free open source sandbox for package installations [1] so if malware does get executed it’s done in a locked down environment. Happy to chat further about this sort of thing, it’s something I’m wildly interested in! [1] https://github.com/phylum-dev/birdcage https://github.com/phylum-dev/birdcage