Adrian —dangerously-skip-permissions Sanabria on Nostr: is this a new attack vector? Typically, I've seen attackers use the NPM install ...

is this a new attack vector? Typically, I've seen attackers use the NPM install scripts to put malware on systems, and they typically leave the package code itself alone, right?