[poink]

There are all kinds of things NPM users can do to mitigate security problems. The only interesting question is what the default is.