Okay, that's good to know. But I'm still uneasy with this, as the crypto hash approach provides some more safety features. For example, it protects against att

Okay, that's good to know. But I'm still uneasy with this, as the crypto hash approach provides some more safety features. For example, it protects against attacks the NPM platform itself (assuming they happen after you incorporated the library into your project). Also, it enables us to download the package from any other source (e.g. some archive/mirror), via plain HTTP, while still being safe from downloading a modified package. That's why I still wish the crypto hashes were included in package.json (automatically on "install --save-exact", of course).