Another supply chain attack, and Crates.io needs to consider this issue

Again, ladies and gentlemen, we have another supply-chain attack on crates.io, and I think the community needs to take a serious stand on this issue.

Right now, crates.io operates primarily on a “push” model, where every developer publishes and maintains their own crates in the public registry. That openness is valuable, but I wonder whether we also need an optional “pull” model: a curated ecosystem where dependencies are added, updated and vendor-ed only after heavy community scrutiny and review.

Something similar to the distinction between Debian Stable and Debian Unstable. End-user developers could then choose between different trust and stability profiles depending on their needs.

Is such a model technically feasible for the Rust ecosystem? Are there already plans in this direction for crates.io, or perhaps even better ideas before the situation gets worse?