I feel the same way, but you are putting the same amount of trust in external services when you run something like 'npm install' already. And don't forget that

I feel the same way, but you are putting the same amount of trust in external services when you run something like 'npm install' already. And don't forget that something like: git clone .... sudo make install is a huge hole for bad things to happen as well.