Comment by willsmith72

I know part of the fun of oss is anyone can contribute behind an anonymous github username, but is this a wake up call for the package owners?

Do we need at least some form of basic identity verification (even in the form of an employer link, LinkedIn, or similar)?