[Risk] Package Phobia

[GeorgLink]

For the Risk Workgroup,

Maybe this tool has some ideas for risk metrics. It calculates the impact (risk) or adding a package to your open source project. They seem to have figured out a way to calculate that, which might be interesting to us.

https://github.com/styfle/packagephobia

[germonprez]

Adding this to the Feb 3, 2021 Risk WG agenda.