"Critical" projects and volunteer maintainers

"Critical" projects and volunteer maintainers

While people may not read the flags on a project, people are using tools like safety to warn them about security issues. If such tools could be configured to also warn about abandoned packages, unauthenticated packages and the like it would at least raise some visibility. NPM for example notifies when projects are seeking donations for example (though no idea how well that works).

Business are taking supply chain risks more and more seriously these days, so increasing awareness might be just enough to get some businesses to devote resources into fixing the problem.