“After GlassWorm showed how quickly a malicious package could self-replicate across npm, and the chalk/debug hijacking ...