> It's about as safe as trusting all the add-ons in your IDE, and all the packages your node app pulls from random package repos.

Absolutely incorrect. You can do far easier due dilligence for IDE plugins