Security in the emacs package ecosystem

[Husain Alshehhi]

Hello,

This issue is not new and seems to have been discussed before:
  
<https://emacs-devel.gnu.narkive.com/atiq1AoP/security-of-the-emacs-package-system-elpa-melpa-and-marmalade>

I was wondering if things have changed since then.

To summarize: most users in emacs downloads packages directly from the git 
repository. This is a security threat as there is nothing to prevent a 
malicious change from going to users. The malicious change could be posted 
through a hack, or could be posted by the owner of the package (in extreme 
cases). Is there anything currently in the ecosystem, or package repository, to 
prevent these sorts of issues? Are there any initiatives or ideas to address 
these issues? If not, what is the recommended (and practical) ways to be safe?

(Some solutions that are typically thrown out: manual code review of every 
package installed. Use distro package manager and have emacs packages go 
through the normal package review process of each distro. Package signing. 
melpa/elpa stamp of approval.)

Husain