This is why banks make you approve transactions on your phone now. The fact that a random NPM package can redirect your money is a massive issue

This attack was enabled by the normalization of orgs' aggressive 2FA postures.