Shai-Hulud is the best thing to happen for npm.

It's much easier to demonstrate a problem (twice!) than to convince a herd that there is a problem.

I hope that other languages with similar package manager (looking at you, cargo) take note.