Who reviews npm packages?

Question

I have just started to use nodejs and npm when learning react native. Various tutorials talk about installing packages using npm. I am always cautious about installing software from the Internet. So, wanted to know if the node packages are reviewed to reduce the risk of malicious intent?

Also, do node packages have a limited scope (are somehow sandboxed, have limited ability to do damage, etc)??

Answer 1

No one reviews them and there is no sandbox. Caveat emptor. If there is something malicious it has to be reported by users, at which point npm inc will review it.

Answer 2

NPM, Inc is the company behind the package manager. You can look at their security policies .