[Rp8yXmdmr]

You are absolutely right. The dangerous part of NPM packages is the post-install script. Therefore moving from JavaScript to Java removes the threat.

[OrangeMusic]

You joke but, yeah, when you think about it, the problem with Javascript is the 'script' part. That's actually correct.