How not to publish malicious npm packages
snyk.io