Comment by oefrha

We should probably start an open source sanction list of individuals who abuse trust to ship malware. The faker/colors guy, node-ipc guy, whoever's responsible for this, etc. Then npm audit or some other checker should crit if there's a package under their control in your supply chain. Well they can assume new identities, but at least we learn about clearly unsafe packages created before any identity change.