Once again, you cannot ask the open source world to provide you with free dependencies and security.

At some point, someone has to pay for an organisation whose job will be to review the contents of all of these modules.

Maybe one could split the ecosystem into "validated" and "non validated" stacks ? much like we have stable and dev branches ?

The people validating would of course give their own identity to build trust. And so, companies (moral person) should do that.