How TypeScript devs can avoid getting pwned by malicious packages
builtbystef.com