I'm now double and triple checking when I add a package to the manifest. You have to check not only that it's the right package, you also check that it has the number of downloads that you're expecting.
We're working on making it similar to email spam. Will post more soon. Meanwhile, we welcome changes that can make it less noisy for the community.
[Edit:] one can specify Github API token to get around rate limiting. We'd deeply appreciate if could create an issue for this on the repo.
We trust that there has been a testing process that validates that things do what they say they will do. Admittedly when dealing with non-OSS vendors you can sue them if something goes badly wrong.
The issue is rather that this is only a largely collaborative one. Which makes the thing kind of worse, because you can _often_ get away with simply trusting everyone and there are economic and practical pressures to do so.