It's a tough problem. But I think mechanisms for rating software packages already exist (GitHub stars for instance). And we have reasonable metrics for whether

It's a tough problem. But I think mechanisms for rating software packages already exist (GitHub stars for instance). And we have reasonable metrics for whether a software package is under active development/maintenance. If we combine those two factors in deciding which dependencies to fund we might be in a reasonable place. Any metric can be gamed of course.