Okay, that&#x27;s good to know.<p>But I&#x27;m still uneasy with this, as the crypto hash approach provides some more safety features. For example, it protects against attacks the NPM platform itself (assuming they happen <i>after</i> you incorporated the library into your project). Also, it enables us to download the package from any other source (e.g. some archive&#x2F;mirror), via plain HTTP, while still being safe from downloading a modified package.<p>That&#x27;s why I still wish the crypto hashes were included in package.json (automatically on &quot;install --save-exact&quot;, of course).