When you npm install a single package like vue or react, it drags in a dependency tree that sources a thousand random npmjs packages. Each of these packages may

When you npm install a single package like vue or react, it drags in a dependency tree that sources a thousand random npmjs packages. Each of these packages may specify a postinstall script that executes at install time. Time and time again, some random leftpad-like dependency might lurk five directories deep and spring a surprise script on you, either because the author is malicious, or they handed over (or sold out) to someone else, or perhaps most likely their npmjs account was simply compromised.