NPM Package Hijacking From the Hijacker's Perspective
I'm not a JS dev, but would it be possible for a malicious actor to create a pre/post install script that looks for packages published by the current user and "worms" its way into those pre/post install scripts?If this were possible, something like this could have the potential to infect quite a few npm modules.