I think this is engendering a false sense of security. NPM's awful documentation doesn't specify whether it's possible for a dependency published 1 year ago to

I think this is engendering a false sense of security. NPM's awful documentation doesn't specify whether it's possible for a dependency published 1 year ago to install, via a wildcard [transitive] dependency, a dependency updated today[0]. I have absolutely zero faith in the NPM devs' having considered this. [0] In fact, it doesn't specify this flag at all. Nor does the command line help, or man page. It doesn't say a word about this, and it appears the only way to determine the semantics of this flag is to run it.