What you're suggesting is a radical departure from how free software has been distributed historically. That goes well beyond Github and NPM.
Walmart does allow other stores to sell through their website.
Github owns and controls NPM, npm is no longer a community-controlled project. Therefore, Github should [happily] take on the duties, responsibilities, and obligations of a software publisher to provide either: trust ratings on packages and code, or literally and not figuratively scan every single package-and-version on npm for appropriateness.
But obviously you already got that point and just wanted to exert some modicum of bossiness and control by having me regurgitate my well-formulated thoughts for a third time while painting inside the lines you insist are relevant.