Moment at 4:27 in A single PR just hijacked the NPM registry... by Fireship.
Using modern package managers like PNPM allows developers to refuse packages published too recently, creating a buffer period where malicious versions are typically caught and removed
Saved by AironD.