Disclosure: I'm the developer of Presend (https://presend.pages.dev), flagging that upfront -- this is a self-interested suggestion.
Saw the MetadataSource pattern via LibrariesIoMetadataSource.cs -- clean extension point. Presend has three free, no-key endpoints that might fit as an additional MetadataSource implementation:
- maintainer-change-check -- flags a publisher change after a long dormancy period, the event-stream pattern
- vulnerability-check -- OSV.dev lookup
- typosquat-check
I don't have visibility into the actual MetadataSource interface/base class contract, so I don't want to guess at C# that might not compile against your real abstraction. Happy to look at the interface and put together a proper PresendMetadataSource implementation if this is a direction that fits OSSGadget's scope.
Docs: https://presend.pages.dev/api
Edit (2026-09-25): corrected an inaccurate claim above. maintainer-change-check matches the event-stream pattern (a previously unseen publisher taking over after long dormancy). It does not detect a hijacked existing account (ua-parser-js) or a malicious release by an existing maintainer (colors.js), and it is npm-only. It now also only flags recent takeovers (last 365 days), after testing showed false positives on years-old legitimate handoffs.
Disclosure: I'm the developer of Presend (https://presend.pages.dev), flagging that upfront -- this is a self-interested suggestion.
Saw the MetadataSource pattern via LibrariesIoMetadataSource.cs -- clean extension point. Presend has three free, no-key endpoints that might fit as an additional MetadataSource implementation:
I don't have visibility into the actual MetadataSource interface/base class contract, so I don't want to guess at C# that might not compile against your real abstraction. Happy to look at the interface and put together a proper PresendMetadataSource implementation if this is a direction that fits OSSGadget's scope.
Docs: https://presend.pages.dev/api
Edit (2026-09-25): corrected an inaccurate claim above. maintainer-change-check matches the event-stream pattern (a previously unseen publisher taking over after long dormancy). It does not detect a hijacked existing account (ua-parser-js) or a malicious release by an existing maintainer (colors.js), and it is npm-only. It now also only flags recent takeovers (last 365 days), after testing showed false positives on years-old legitimate handoffs.