This is why I'm hesitant to buy Google AI again. I don't want to risk some npm install compromising my Google account which also happens to do AI coding.