This is odd, because I work at Google, on open source projects, and inadvertently created this exact same vulnerability on npm (due to using a fake package name

This is odd, because I work at Google, on open source projects, and inadvertently created this exact same vulnerability on npm (due to using a fake package name for an unpublished monorepo utility package). We fixed* this right away, because even though it's true that this "vulnerability" exists with basically every npm package, the difference is that anyone can immediately pull this off once they find an unpublished package in use - they don't have to take over an existing package or get a package they own to be used. It's the ease of the executing exploit that makes this one more dangerous. Some bored kid could have just wiped my hard-drive or worse, maybe within a few minutes if I'm working. * An easy fix on npm is to create an org that you use for all internal packages. No one else can publish to that org.