> Really makes me wonder what npm install is doing Pattern matching. For every dependency listed in package.json, npm install downloads and tests every JSON p

> Really makes me wonder what npm install is doing Pattern matching. For every dependency listed in package.json, npm install downloads and tests every JSON payload publicly available on the Internet until it finds one that produces the desired npm package.