This is a credentials and access list oAuth style problem, and not really intractable.

For package X, I should be able to present my npm (homebrew, apt, nuget, etc) credentials with publishing rights for the package.

If package X is of sufficient public interest (user count, nature/sensitivity of user data, downstream distribution, etc), then the public interest + cryptographic credentials should permit access to best-available security auditing.

Yes, we still are trusting trust, that the owner of the package itself is not malicious, but that's not a sharp degradation from status quo.