It's more than the security of your project. For example, NPM dependencies get installed not only on the build server, but also on the laptops of developers. T

It's more than the security of your project. For example, NPM dependencies get installed not only on the build server, but also on the laptops of developers. These laptops are connected to VPNs, so malware can get into corporate networks. Also, they can rootkit dev and production servers, so your coworkers and users might be getting served malware as well.