I want a network of trust, such that a Google reviewed package is worth 10 points, a package fuzzed by foobar is worth 2 points, something skimmed by a dependant user is worth 1 point etc.
I can then chose a compromise between a highly rated/reviewed dependencies and functionality/risk/cost-to-review.
My own blessing of a package I have reviewed might become a very small signal in a web of trust.
Ironically this depends on a whole slew of additional packages I haven't yet reviewed to build ;)
Very recently (2 commits starting 8 days ago) someone started on an npm equivalent but it's not in a usable state yet: https://github.com/kspaans/npm-crev/blob/master/TODO.md
Two problems - few people out there reviewing code, and poor discoverability for who else is reviewing code that you might trust at the moment.
[1] https://npms.io
BTW: I used to think the dependencies that came as part of for example the official Angular packages where vetted.
Can anyone confirm or deny this?
Anyone can