> so trusted packages can be trusted indefinitely If you specify an exact package version, you can trust that to be immutable. NPM doesn't allow replacing of e

> so trusted packages can be trusted indefinitely If you specify an exact package version, you can trust that to be immutable. NPM doesn't allow replacing of existing versions, only addition of new versions.