Imagine your org gets compromised and they are tracing back the vuln to a malicious package in the supply chain, and it's the Mr. Meeseks Claude Code plugin.

It will surely be the npm package port