How to Vet an npm Package Before You Install It

Every time you run npm install , you are adding code that will execute in your production environment: code written by someone you have never met, with access to whatever your process can reach. It might touch your filesystem, make…