Well, how do you know it's "just" a mirror service, and it is not using a zero-day to exploit your system, by installing a root-kit or copying your code to their servers?
If you're concerned about injection into a third-party package, you should be using `package-lock.json` (or equiv) and integrity hashing your dependencies at install time.
signed packages would go some way towards better distributing npm
In fact, you can compare the installed dependencies code line by line, Javascript won't be compiled anyway.