[siddhant]

If they can inject something like that in the output, they can also do something funky on your dev machine. Which means I shouldn’t be installing any npm package.

[Walkman]

You are correct! :D