Programming

The collaborative sharing nature of these platforms is a big advantage. (Not just VS Code Marketplace. We have this with all extension and lib and program package managers.)

Current approaches revolve around

• reporting
• manual review
• automated review (checks) for flagging or removal
• secured naming spaces

The problem with the latter is that it is often not necessarily proof of trustworthyness, only that the namespace is owned by the same entity in its entirety.

In my opinion, improvements could be made through

• better indication of publisher identity (verified legal entities like companies, or of persona, or owned domain)
• better indication of publisher trustworthiness (how did they establish themselves as trustworthy; long running contributions in the specific space or in general, long standing online persona, vs "random person", etc)
• more prominent license and source code linking - it should be easy to access the source code to review it
• some platforms implement their own build infrastructure to ensure the source code represents the published package

Maybe there could be some more coordinated efforts of review and approval. Like, if the publisher has a trustworthiness indication, and the package has labeled advocators with their own trustworthiness indicated, you could make a better immediate assessment.

On the more technical side, before the platform, a more restrictive and specific permission system. Like browser extensions ask for permissions on install and/or for specific functionality could be implemented for app extensions and lib packages too. Platform requirements could require minimal defaults and optional things being implemented as optional rather than "ask for everything by default".