Are you being serious?

https://www.cpomagazine.com/cyber-security/open-source-devel...

https://therecord.media/malware-found-in-npm-package-with-mi...

...

and the list goes on