wonder if this is possible with flutter packages or python? im looking to slowly get away from javascript ecosystem.

ive started using Flutter even for web applications as well, works pretty well, still use Astro/React tho for frontend websites so I can't completely get away from it.

The code is literally right there for you. It doesn't matter what ecosystem or package manager. Someone could distribute the same thing anywhere — it's up to those pulling it in to actually start auditing what they're accepting.

PyPI has had compromised or fake packages in the past.

yes it is possible with rust, python, php, and likely many others