DO they also inspect the hundreds of npm packages an extension might use?