I think that volunteers (some of them maybe paid) should check the validity of code, at least for projects over 10-100k downloads. In case of crates.io (Rust), there is cargo-crev[1]. Also, npm should popularize 2FA.

[1]https://web.crev.dev/rust-reviews/