I'm not saying its immune. I'm saying that NPM doesn't have as many protections, making NPM an easier target.