Reminder to always run all npm commands inside a sandbox. I wrote amazing-sandbox[1] for myself after seeing how prolific these attack vectors have become in recent years.

1 - https://github.com/ashishb/amazing-sandbox