The fact that NPMs entire ecosystem relies on this not happening regularly is very scary.

I’m extremely security conscious and that phishing email could have easily gotten me. All it takes is one slip up. Tired, stressed, distracted. Bokm, compromised