The JS ecosystem isn't known for its safety/security but this one is pretty wild.👇
npm doesn't validate/compare a package's tarball and manifest.
You basically can't trust any info on npm relying on manifest metadata.😥
Kudos to @darcy for uncovering!
blog.vlt.sh/blog/the-massi…
