Hardening npm as a Consumer and Publisher

Axios got compromised, but the bigger lesson is how to harden npm as a consumer and, if relevant to you, as a publisher too.