I used Zotero quite a bit in the past, the thing that ultimately drove me away is that when synchronizing you couldn't easily access the PDFs just via the filesystem. I use a nextcloud and also wanted to access PDFs from devices without Zotero installed and this turned out to be a pain at the time. Is this possible with more recent Zotero versions? Is the sync still cumbersome with a zotero account + self-hosted webdav?
Many people here say that slowing down is a must -- and I agree it's probably the best solution -- but surely there are more approaches we could think of:
* Not allowing packages with similar names to popular ones
* Not allowing packages creation to be anonymous (in the extreme case you would require to validate your passport or similar)
* Automatic detection of malicious code
* Central auditing organization
...
This is just on top of my head, there must be many more ideas.