It has been proofed again and again that you cannot trust npm/cargo not even AUR, implement you own minimalist functionality without dependencies and just for you own needs seems to be a much better solution.