Wasn’t there that npm malware thing a while ago that trashed your home folder if it couldn’t phone home?