Aliakbar Zahravi

One transitive import is enough: 14 npm packages that run a Linux backdoor with no install hook

Trend Micro says the loader fires when the module is imported, not when it is installed. That moves the only workable control from install-hook scanning to knowing every name in the resolved tree.