Just to clarify, we won't just mirror any npm package. We have a set list of git repos and npm packages that we pull from, and adding a new one requires a PR to our packages repo which a human must review.
Because if he did that symlink should at least raised some eyebrows at least