Right, but they’re probably mirroring dependencies locally, scanning them regularly, and have a process for adding new ones that isn’t “npm works on my desktop”.