So this is advertising as a secure npm?