These aren’t the npm packages you’re looking for
Blog post from Snyk
The npm ecosystem has seen a rise in malicious packages being released, which can lead to dependency injection and security vulnerabilities. To protect applications from these threats, developers should perform due diligence by understanding the functionality of their chosen open source packages and using tools like Snyk Advisor to gauge support and identify potential vulnerabilities. Building dependency trees can also help spot packages added through a library or dependency, making it easier to generate a software bill of materials. Additionally, regular scanning with a software composition analysis tool like Snyk Open Source can provide ongoing alerts for new vulnerabilities and suggest remediations, helping developers maintain application security.