A useful step in parallel to this would be making sure that every NPM package is built from the source code that the metadata claims it is built from: https://

A useful step in parallel to this would be making sure that every NPM package is built from the source code that the metadata claims it is built from: https://hackernoon.com/what-if-we-could-verify-npm-packages-c2a319cff758 https://hackernoon.com/what-if-we-could-verify-npm-packages-...