How about assigning a trust level to each package. Level 0 - Free, unchecked package, Level 1 - reviewed by at least one moderator, Level 2 - developer bought a $100 license + reviewed, etc. Then it's up to package consumer to decide which package they trust.