I'm glad we don't see this in npm post-install hooks... yet
we live .io era these days (sadly)
There is/was .ai for a bit but its less generic.
--
[0] - https://www.infoq.com/news/2019/08/npm-bans-package-ads/
I'm very much not a fan of ambient authorization.