> Only one typo in an import statement up the dependency chain and you’d be compromised. Doesn’t even have to be a typo if the actual project is compromised. L

> Only one typo in an import statement up the dependency chain and you’d be compromised. Doesn’t even have to be a typo if the actual project is compromised. Like one of the 100s of NPM modules without 2FA for publishing.