It would be great to make the packages immutable, doesn't allow the maintainer of the package to change code on the website, malicious or not.