[sandreas]

Thanks for sharing.

I still wonder why this is not an official npm / node effort to better secure the ecosystem...