NPM supply-chain attacks spread really quickly.

If a popular NPM package was compromised and included a copy.fail exploit, it would make lots of systems vulnerable to root privilege escalation.