That's a kneejerk reaction that will likely have more negative consequences than positive ones, and it likely wouldn't even have helped in this case. Do you think that sophisticated actors, especially state level actors, aren't capable of giving fake IDs to people? Or to have a web of equally fake identities vouch for someone?

Every project potentially has security implications. A package that's used for compression today could be linked to an SSH server tomorrow. Something as banal as a todo list could be a potential attack vector in the right hands.

I don't know what the solution to this problem is. Better verification of dependencies, certainly, but how? More investment by corporate users of FOSS into security? But no matter what we do, "who's watching the watchmen" will remain a valid question.

I'm actually quite impressed that this was found as quickly as it has, though it makes me wary that there might be other, as yet unfound, such attacks.