[zenmac]

You can host your own NPM reg, and examine every package, but your manager probably is NOT going to go for that.

[venturecruelty]

Sounds like something a union should enforce as part of a drive to protect programmer professionalism.