What is a good review? Or different tiers of review? When thinking about packages, say in npm world, I still wonder about trust within nested dependencies. New users might also be unfamiliar. Any thoughts or any guidances?