Yeah, that is true. And npm as a whole doesn't really have a good track record in being worthy of a lot of trust.