You don't just have to trust the package, but all of its transitive dependencies as well.

Node apps should be developed in isolated containers or VMs.

We need peer review of every update, imo.

Starting to think checking node_modules into an app repo, so you get update diffs, is sane.