It should be noted that in npm, examining the source of the package tells you absolutely nothing about whether you should trust the package - the actual blob th

It should be noted that in npm, examining the source of the package tells you absolutely nothing about whether you should trust the package - the actual blob that you download need not be generated from the same source.