Comment by naugtur

npm is on life support by msft. But there's socket.dev that can tell you if a package is malicious within hours of it being published.