But that woukd make injecting actual malware much more difficult.

npm install defaults to using version ranges in package.json