Or, worse, an npm-infected frontend engineer. It's like a mindvirus in that ecosystem.