If packages are "trusted", how would NPM ensure that they are continually trusted as new versions come out? I've read those stories with packages whose developers hand them over for maintenance, and then a new update comes out with malicious code