The downside is now I need to know Golang to audit my JavaScript project.

And it runs a post-install: node install.js

So I do really have to trust it or read all the code.