> who’s to say that what you see in /lib/package.min.js is the real result of minifying /src/package.js? This is why NPM really needs to start demanding that p

> who’s to say that what you see in /lib/package.min.js is the real result of minifying /src/package.js? This is why NPM really needs to start demanding that packages (with more than N downloads per month) are reproducibly buildable from source. Someone did actually produce a tool for performing these checks[0], specifically with the linked article in mind, but unfortunately the online service connected to the tool has been discontinued. [0] https://medium.com/hackernoon/what-if-we-could-verify-npm-packages-c2a319cff758 https://medium.com/hackernoon/what-if-we-could-verify-npm-pa...