It's telling that we keep remembering xz to this day, while npm has these incidents on what feels like every single week.

I mean, we're catching the ones on NPM. Who know how many xz's are hidden.