depthfirst adds pre-install protection against malicious dependencies