Mitigate this attack vector by adding:

  ignore-scripts=true

to your .npmrc

https://blog.uxtly.com/getting-rid-of-npm-scripts