Comment by timeon

You do not know if developers are malicious when there are many contributors.

Now we are talking about NPM other time about: https://en.wikipedia.org/wiki/XZ_Utils_backdoor