Why a person reads every node before it ships
Publishing to npm is permanent after 72 hours. That single fact shaped the whole review queue — and it is also why we are careful about what the review does not promise.
You can download your node and install it yourself at any time. Nothing is reviewed, nothing is queued, and we never see it. That path is instant and it is the one we recommend while you are still iterating.
Asking us to publish it to npm is a different act, and it gets a different answer.
npm does not have an undo
Roughly 72 hours after a package is published, npm will not let you remove it. You can deprecate it — a label — but the code stays downloadable forever. Anyone who installed it keeps it.
So a publish is not a save. It is a release, and the review queue exists because a release deserves a second pair of eyes.
What the review actually checks
A person looks at where the node points, whether it does what its name and description claim, and whether the author ran it against the real API before asking. That last one is why the builder records your test runs: a green result you produced is stronger evidence than any promise on a form.
An overstated check is a liability, not a feature. If we implied every node was audited, the first one that was not would be our problem.
So it is worth being precise about the limits. The review is not a security audit, not a legal review, and not a guarantee. Approval is not endorsement. A node that passes is a node that looked reasonable to a careful reader — which is useful, and is not the same as safe.