Comment by pjmlp

The solution already exists.

Nexus, Artifactory, and many others.

Security minded organisations don't allow cowboy installs into projects, the systems are configured to use internal repos and only IT validated packages got uploaded into them.

Still it might be of value to single devs.