Identity verification is the only reliable option for popular public package registries that want to avoid becoming a cesspool of malware. The problem with ide

Identity verification is the only reliable option for popular public package registries that want to avoid becoming a cesspool of malware. The problem with identity verification is that it can be expensive for you, the registry (reliable implementations require things up to video call verification in case of doubt), and risky for your users (who will have to trust your or your verification partner’s infosec practices with their PII). Ideally either of those, but if you screw up—both. It’s also crucial to remember that identity verification is never a guarantee: you cannot dispense with any pre-existing measures, like manual package review and user reports, to recoup the costs. All in all, it is inevitably an expensive undertaking and a sad example of the tragedy of the commons.