npm包发行者与维护者变更审计治理（所有权转移-风险）最佳实践

实现示例type OwnerChange = { pkg: string; from: string[]; to: string[]; time: number } function risk(ch: OwnerChange): number { const delta = Math.abs(ch.to.length - ch.from.length) const emptyRepoPenalty = ch.to.length === 0 ? 10 : 0 return delta * 2 + emptyRepoPenalty } function decide(ch: OwnerChange, thresholds: { block: number; warn: number }): 'block' | 'warn' | 'pass' { const s = risk(ch) if (s >= thresholds.block) return 'block' if (s >= thresholds.warn) return 'warn' return 'pass' } 审计与运行治理审计所有权变更并评分；阻断高风险包并触发冻结与复核。例外需到期与审批，支持回溯与对比。