Turn off install scripts and allow the few that need them
Every npm worm this year ran in a postinstall hook. With scripts off, a poisoned version is downloaded and does nothing until your code imports it, which you get to catch.
# .npmrc
ignore-scripts=truepnpm 10 has this on by default plus onlyBuiltDependencies for the handful like sharp and esbuild that really need a build step.
securitynpm
Longer version: the post this came from.