Yikes! NPM can be an attack vector if you don't understand how it works and what it does.