Comment by cyral

Your first paragraph reminded me of this article: https://david-gilbertson.medium.com/im-harvesting-credit-car... Imagine this scenario taking place with this package if someone got ahold of his NPM account.