It is 2018 and people still think npm is an acceptable distribution mechanism for their programs
@jordyd I have similar issue with composer. There's no validator between the packager and deployment, why people blindly trust it is beyond me.