My company went into full panic mode after this. 5 minutes later dependabot opens and auto merges a random patch from npm, but that's fine.
Say what you want about dependabot, and people who allow it to auto-merge changes, but at least NPM releases are not mutable (... anymore, at least. NPM had to learn that one the hard way, but unlike github it actually learned something).