> you won't find us loading arbitrary JS from a random GitHub user's account

You load arbitrary JS from a random GitHub user's NPM package. What's the difference?