Very few packages actually contain minified sources - it's not really needed with modern build tools. I think it was an exception in this case, and that by itse

Very few packages actually contain minified sources - it's not really needed with modern build tools. I think it was an exception in this case, and that by itself could be suspicious. Current version of npm now contains a package-lock.json file which is made to make builds pretty close to deterministic. It contains the entire dependency tree of dependency names, versions, and hashes. I say pretty close because it's still possible to break "npm install" by unpublishing a package.