fixup! add some asserts showing npm metadata is passed unharmed