Open Source Malware, NPM, and the Risk of Helpful AI

I don&rsquo;t think most practitioners spend a lot of time worrying about malware hidden inside an open source package. We worry about vulnerable code, sure. We worry about breaking changes, unplanned upgrades, and the occasional dependency rabbit hole. But malware? That still feels like something that happens to someone else, somewhere else, through an obviously sketchy email attachment.…