Are they reproducible? Shipping binaries in JS packages is dodgy AF - a Jia Tan attack waiting to happen.