This article is four years old but still relevant: https://overreacted.io/npm-audit-broken-by-design/

The vast majority of "compromised packages" are just dev dependencies that have a slow regexp.