Is there a way to get stats on suspicious activity on NPM repos? I feel like this is a service that every node.js project is in need of after left-pad and now this.
But this wouldn’t catch issues with pushing immediately after being granted access, new github accounts pushing changes to libs with thousands of dependents, libs whose dependencies were yanked from npm. Only published vulnerabilities, right?
My apologies, I assumed you meant ones with known vulnerabilities. Given OP's link that was a bad assumption to make.
check them into your git
How does that help? You still update from time to time get fixes, new features and then you can get some unwanted code which is not discovered yet.
it enables you to run git diff after updating your npm dependencies, so you at least have a chance to detect something shady
In this situation, wouldn't it tell you the package had a version bump?
and/or use fixed versions with package-lock. Or private npm cache if you are concerned.