why do you think if we can not understand the dependency chain, the regulators and the auditors can?
$ ls -la
-rw-r--r-- 1 jack 197609 330905 May 4 22:56 watch.js
-rw-r--r-- 1 jack 197609 152172 May 4 22:55 watch.min.js
$ gzip watch.js
$ gzip watch.min.js
$ ls -la
-rw-r--r-- 1 jack 197609 43690 May 4 22:56 watch.js.gz
-rw-r--r-- 1 jack 197609 32507 May 4 22:55 watch.min.js.gz