Why can’t pypy / npm / etc just scan all newly uploaded modules for typical malware patterns before the package gets approved for distribution?
False positives where it incorrectly flagged a safe package would result in the need for a human review step, which is even more expensive.
False negatives where malware patterns didn't match anything previously would happen all the time, so if people learned to "trust" the scanning they would get caught out - at which point what value is the scanning adding?
I don't know if there are legal liability issues here too, but that would be worth digging into.
As it stands, there are already third parties that are running scans against packages uploaded to npm and PyPI and helping flag malware. Leaving this to third parties feels like a better option to me, personally.
Seems too late to me. At this point the module/package was already added into the ecosystem, it could potentially be some time (months?) before it is flagged by third party and removed.
The word "just" here always presumes magic that does not actually exist.
The magic here is, yes, AI. If you look at the mobile app stores, they've all become much better, although false positives occur, of course.
There are a small number of PyPI things they require human support queues at the moment and they are sometimes overwhelmed already.