The rare phishing attack is hardly the danger with NPM. It's the implicit trust you put in some random person on the internet to not mess with your production c

The rare phishing attack is hardly the danger with NPM. It's the implicit trust you put in some random person on the internet to not mess with your production code. The left-pad debacle was a benign beginning to what is now a full blown existential crisis for the JS community. There is so much incentive out there to compromise a package now, and so many packages, and so little oversight, that it's inevitable.