IMHO the primary issue at play here is that publishing to the npm repository doesn't currently require proof of user presence, which enables a worm to propagate

IMHO the primary issue at play here is that publishing to the npm repository doesn't currently require proof of user presence, which enables a worm to propagate to other packages automatically. The npm team is working on 2fac (https://twitter.com/seldo/status/713623991349411840 https://twitter.com/seldo/status/713623991349411840) which will be an adequate solution to this issue.