Produce a score for each maintainer based on their trust in the ecosystem. Consider using something similar to PageRank. Then, use the Maintainer Score as a factor in the Supply Chain Risk score.