Check the backlink profile for pages ranking for spam-dominated queries such as "buy CBD oil" or "buy viagra" and you'll see an incredible amount of spam and fraud.

Sucks that despite this being a 20+ year old problem, Google hasn't been able to fix it.

If 'npm package update' includes the ability to modify strings in served pages, one would assume so.