This is a significant vulnerability, but the mechanisms required to use the exploit would indicate that a hostile intruder has already gained significant control. For example, if the intruder can ...

I have concerns about NPM too, but I think it is absurd to just sweat that when it has proven NOT to be the source of most of our security issues generally. We could 'fix' NPM or just not use it, and ...