That's so interesting, GCHQ! I don't know if that makes me trust it more or less than other random code online. (It's a little like installing some nice free software from the friendly people at the NSA, in case you're unfamiliar.)
I did have a quick look at the repo, in case there were some useful security practices I could learn from. But it's just your standard NPM dependencies with a 20K-line package-lock.json. I wonder if perhaps they don't use it internally. Or if they do, perhaps they shouldn't.
The issue with web applications is that you need to do due diligence to make sure that it won't send any of the data you're pasting in to some remote server. FWIW you need to do this with third party tools in general.