This mostly defends against name squatting and other malicious dependencies that...

		theteapot on March 26, 2025 \| parent \| context \| favorite \| on: Malware found on NPM infecting local package with ... This mostly defends against name squatting and other malicious dependencies that never get imported. Haven't reviewed code but article says its entry point is install script. install scripts don't run on import. I guess you saying it triggers from import too.