Comment by lockhouse

I’m honestly surprised this sort of thing doesn’t happen more often.

One of the fastest ways to monetize an open source software package is to sell your GitHub login to a bad actor or put malware in it yourself.

It would be extremely easy for a state level actor to compromise an npm dependency through bribery or blackmail.