Comment by jdcaron

Yes, and second analysis by an independent party: https://socket.dev/blog/npm-provenance