Compare this with Rubygems - the only test results I see for that ecosystem are the many recent remote shell exploits showing up on seclists.org. Even Pypi doe

Compare this with Rubygems - the only test results I see for that ecosystem are the many recent remote shell exploits showing up on seclists.org. Even Pypi doesn't really compare with CPAN. They've done good work there but the simple idea of author names and source archives on a file server you can builds tools around has proved more robust and extensible than a focus on the web services and tools upfront.