Worse than that, I think. You can claim the npm account that published the package has zero relation to your github page that hosts the untainted source. The a

Worse than that, I think. You can claim the npm account that published the package has zero relation to your github page that hosts the untainted source. The amount of times I've gone to npmjs.com, looked for the "official" version of a package only to get lost in a web of conflicting version and ownership "signals" is staggering. And yet... if it's on npmjs.com, then it's going into your package.json. No one audits that thing. Unless there is an obvious bloat issue. And dependencies of dependencies? NEVER. We have something like 400MB of shit in our node_modules folder. There is no human on earth that could go through that. This is a few times the size of the entire Linux kernel, for context. And it's minified.