> fake or infected Zoom binaries, Xcode binaries, etc.

There are so many hoops to go through to pull something like that off, it's basically impossible. It would be a "the great train robbery" kind of effort. I also don't think an npm package could alter an existing app or obtain screen access otherwise, unless you're running `sudo npm install` routinely.

Some form of phishing would be way more likely to succeed, luckily you can use your own brain to protect against those attacks.