The list you speak of already exists — it is the package registries of Debian/Ubuntu, RHEL, etc. What about American companies using mainland China developers

The list you speak of already exists — it is the package registries of Debian/Ubuntu, RHEL, etc. What about American companies using mainland China developers to drive their (well known) open source projects with crappy code? Who’s to blame? We’re currently smoking at the gas station and things haven’t blown up yet…