Comment by replete

A whitelist in package.json is only a partial assist