Interesting. As a developer, I've never had trouble assessing the trustworthiness of packages on github, and I see no reason to implement some kind of trust system for language specific repos (npm, for example). The reason is simply that there are many ways to assess a library, such as community activity, use in production, quality of tests, and general reputation.
Perhaps this is more of a problem for scientists who just want to download and use a package, but don't have the know how to assess the quality of a package the way developers do?
Perhaps this is more of a problem for scientists who just want to download and use a package, but don't have the know how to assess the quality of a package the way developers do?