[warpech]

Well, how do you know it's "just" a mirror service, and it is not using a zero-day to exploit your system, by installing a root-kit or copying your code to their servers?

I agree that it's a valid concern.

[gpmcadam]

If you're concerned about injection into a third-party package, you should be using `package-lock.json` (or equiv) and integrity hashing your dependencies at install time.

[wp381640]

signed packages would go some way towards better distributing npm

[lqs469]

In fact, you can compare the installed dependencies code line by line, Javascript won't be compiled anyway.