> not the GitHub repo He did that too actually. > you can easily have a GitHub repo for your NPM package with benign code in the GH repo and completely differ

> not the GitHub repo He did that too actually. > you can easily have a GitHub repo for your NPM package with benign code in the GH repo and completely different, malicious code in the package This is one of the biggest issues that NPM has, along with not enforcing packages to be signed. If the package was signed this would not be an issue as people would see that the signer changed.