Were the chances than an npm package is crap factored in?