I went a different route with my "malicious" NPM package. See if you can figure it out [1]. Years ago I played around with the idea of verifying that a npm pac

I went a different route with my "malicious" NPM package. See if you can figure it out [1]. Years ago I played around with the idea of verifying that a npm package is the same code found in the source repo [2]. Because there is often a build step, that requires trying to reproduce the building of any arbitrary package, and flagging when there is any delta between the build output and the code distributed via NPM. In more reasonable package managers, this is true by default given that you provide the source code and the package manager builds it for you ... as opposed to NPM, which just asks for the executable code directly. [1] https://github.com/connorjclark/totally-fair-rng https://github.com/connorjclark/totally-fair-rng [2] https://github.com/connorjclark/npm-package-repro https://github.com/connorjclark/npm-package-repro