I almost forget this gem from 2023:
https://www.vlt.io/blog/the-massive-hole-in-the-npm-ecosystem
Basically #npm allows you provide a package manifest that diverges from the pakcage.json inside the tarball. And the registry happily lists whatever you submit on their API.
Now I have too extract the tarball to make sure. sigh.
vlt /vōlt/The massive bug at the heart of the npm ecosystem | vlt /vōlt/An article detailing the massive bug at the heart of the npm ecosystem; encompassing a lack of validation by the public registry, package manifest inconsistancies & assumptions about package managers & security products