npm包发行者与维护者变更审计治理（所有权转移-风险）最佳实践

实现示例type OwnerChange = { pkg: string; from: string[]; to: string[]; time: number }

function risk(ch: OwnerChange): number {

const delta = Math.abs(ch.to.length - ch.from.length)

const emptyRepoPenalty = ch.to.length === 0 ? 10 : 0

return delta * 2 + emptyRepoPenalty

}

function decide(ch: OwnerChange, thresholds: { block: number; warn: number }): 'block' | 'warn' | 'pass' {

const s = risk(ch)

if (s >= thresholds.block) return 'block'

if (s >= thresholds.warn) return 'warn'

return 'pass'

}

审计与运行治理审计所有权变更并评分；阻断高风险包并触发冻结与复核。例外需到期与审批，支持回溯与对比。