Packages downloaded from NPM can fetch dependancies from untrusted sites.