npm has the bad practice of erasing the evidence. I use Socket more for this now than the npm website.