My next supply chain idea
- a tool to diff each version to detect when a package has been highjacked
(Potentially) Bad signs
- Binaries (bad because opaque, good because you don't have to run code arbitrary at install time)
- Large diffs
- New file types
What would be cool is a crowd sourced code review where people could review a diff and leave a LGTM on new versions & people could skip installing a version w/o a crowd sourced code review.