It's exactly like npm packages. But it seems every time there's a new technology, we abandon the security practices that we had before...