On: Backdoor in event-stream library dependency

[shados]

Not sure how that would help. Anyone can publish anything to npm, it doesn't even need a repository. So unless the source code itself was hosted on npm, and the entire toolchain was controlled by npm, there's not much to do.

[g-harel → shados]

Exactly, I think a source code browser on https://www.npmjs.com/ would be nice to have