I could be a "risk assesment" service. For a given package it could run an automated web-of-trust on it together with an analysis of past history of vulnerabili

I could be a "risk assesment" service. For a given package it could run an automated web-of-trust on it together with an analysis of past history of vulnerabilities and of its mantainers. You can also add watchers to check who is allowed to publish new versions ad see when that list changes. Even without looking at the code you could gather a useful report.