If they can inject something like that in the output, they can also do something funky on your dev machine. Which means I shouldn’t be installing any npm package.