Worried about occasional npm malware scares? They're more common than you may think