Would be great if npm->github->microsoft partnered up with https://socket.dev to get a crude filter and take down any obvious malicious/spam packages.