> Each new participant automatically contributes its audits back to the commons, making it progressively less work for everyone to secure their dependencies.<p>This is really exciting and I hope it gets adopted by all package ecosystems.<p>Of course audits can't guarantee to find the most underhanded "bugdoors", but it will still be a huge step forwards if third parties can vouch for various properties of the code you are about to install, such as it being reproducibly built from a tagged release on a public repository, with no Unicode homoglyphs or unexplained high-entropy strings in the code, and the unit tests all passing.<p>This will naturally lead to the question of who can be trusted to provide these audits, but such automatable checks could be done by almost anyone and their reputation could grow with time (which might lead to second-layer systems which track which auditors make the most accurate claims). Perhaps there will be companies that offer cyber-insurance against these specific threats, and use the premiums from that to fund the audit checks.