@teidesu @niconiconi provenance statements are cool so you know how the sausage is made but are entirely useless when it's a backdoor injected by the project themselves, as is often the case for npm stuff.