We need to apply zero-trust everywhere. How do we know anything about anyone online? Unless it comes from a respected company, any npm project author could be a malicious actor just waiting to hit some large number of downloads to surreptitiously add a crypto-miner to it.

I think we just need to assume all of them are bad actors and review our dependencies (yes, unlikely to happen in practice given limited resources but that's a problem for someone else to solve).