the package maintainer has to go through a web of trust in their FOSS ecosystem to be allowed to distribute their packages.

A github author just has to put up a repo and hope that their fanbase aren't too versed in the language