[lozenge]

Some mitigations could be:

Auto-flagging every push from an account for a while after a password reset

Automatically scanning code of frequently downloaded packages for unusual changes (like: adding a postinstall script, contacting a new server in the postinstall script, obfuscated code, near-total rewrite of the code, inclusion of cryptomining, access of sensitive files like /etc/passwd or /etc/sudoers).

The vagueness of the statement suggests to me they're talking about their defense-in-depth and have never thought about this specific route to account takeover before.

[jefftk]

In this case, if NPM has any mitigations like that, they would not have been triggered, because the reporter stopped once they had full access to the account.