Moment at 5:03 in A single PR just hijacked the NPM registry... by Fireship.
Because most NPM malware relies on automatic install scripts, configuring your project to block all scripts by default and only whitelisting trusted dependencies is a vital defense mechanism
Saved by AironD.