JavaScript Packages Index, security: security review needed