Moment at 4:39 in A single PR just hijacked the NPM registry... by Fireship.
Security features can actively block dependencies that point to unverified sources, such as random Git repositories or attacker-controlled S3 buckets, closing a common smuggling route
Saved by AironD.