This. Any package can be anything at any time. Remember when left-pad (10 lines of code) was deleted by its author in 2016? Build systems all over the world fai

This. Any package can be anything at any time. Remember when left-pad (10 lines of code) was deleted by its author in 2016? Build systems all over the world failed so hard, NPM had to reinstate the package against its own rules. left-pad's author could have done anything with all the dependencies on his package.