We laugh about AI deleting all the shit, but every day there’s a new npm package ready to exfiltrate all your data, upload it to a server and encrypt your home. How do you protect yourself against that?

Yes, by not using npm either.