The npm package you installed yesterday might own your machine. (opens in new tab)

You ran npm install. You went to get coffee. When you came back, a background script had already sent your .env file, your AWS credentials…