Comment by jopsen

Or just burn some tokens scanning packages for bad behavior.

Granted some human will likely have to review it. Or packages flagged by Al could require users to explicitly allowlist them.