Some great tips in this thread and I've been collecting them all at https://github.com/bodadotsh/npm-security-best-practices