I know sockets probably aware of this, but the root scam seems to start with forks of existing libraries. NPM should be doing some finger printing of new proje

I know sockets probably aware of this, but the root scam seems to start with forks of existing libraries. NPM should be doing some finger printing of new projects and flag any that dont meet a reasonable threshold. Obviously obfuscation will occur, which could become its own subsequent flag. Anyway, keep up the good work feross.