john spurlock 2018 : "the remaining option is to treat all npm packages as potentially hostile, and that's kinda terrifying." jakearchibald.com