Does this happen with CPAN?

At least they seemed to have policies:

https://security.metacpan.org/