Seems like a lot of this could be solved with a whitelist of trusted dependencies. There are already lots of groups maintaining internal lists and analysis of

Seems like a lot of this could be solved with a whitelist of trusted dependencies. There are already lots of groups maintaining internal lists and analysis of dependencies they trust. If there was a platform for reporting safety, rather than reporting vulnerability, one could say "Only allow packages that someone from a fortune 500 company publish an analysis of".