I believe this is a better approach for scale.

Make it a local or company-wide identification of FOSS packages, and a way for those individuals, teams, and businesses to score them by importance or criticality (or needs of the FOSS project if they are aware).