It contains a reference to source code in the package server that is disconnected from the package author so it's retrievable in the event of a left-pad-like ev

It contains a reference to source code in the package server that is disconnected from the package author so it's retrievable in the event of a left-pad-like event. This is what's queried upon download in order to ensure that no funny business could lead to a security threat down the line either. It's kept on the package servers as an immutable source of truth referenced by the UUID and SHA.