I sorta trust my direct dependencies in node-world and have some idea who is responsible and if they are reputable. But there's approximately 1187 other subpackages nested ad nauseum under those dependencies, and there could be anything at all hidden deep in the bowels of that mess, with some malicious party potentially injecting who knows what.

I hate it, but this is what we have made it. I hope that we aren't getting riddled with backdoors and keyloggers and miners, but I wouldn't want to lay money against it.