[slavik81]

It seems harder to verify that the module maintainer is competent and trustworthy (and to keep up-to-date on maintainer changes).

[mattdesl]

In the case of is-object the api is frozen, and with any module it's assumed that any breaking changes would come in via a major version (ie not break your code).

Yeah, sure, if the maintainer becomes evil overnight he can break a lot of apps. If you live in fear then you probably won't enjoy npm very much.