t.f.w. “npm install somePackage” adds hundreds of names to your supplier list, some of whom aren’t even adults let alone companies, and the policy says that each new supplier needs to go through a thorough vetting process.