How GitHub could secure npm - Human Who Codes
humanwhocodes.com
Why doesn't npm detect compromised packages the way credit card companies detect fraud?