> which filter based on their from addresses makes all the legitimate ones show up as the same sender while excluding the phishing email?

This is the wrong question.

The right question is: what should we do about the fact that the organization has such terrible security practice?

And the answer is: call them on the phone, and tell them that you will not do business with them until they fix their shit.

You're not doing business with NPM by pushing packages there.

And who is going to do anything about fixing their stuff when you pay them a mere subscription fee?

[dead]