Here's an idea: permission system for NPM packages