One npm Account Publishes 964 Million Downloads Per Week. None Have Provenance.

The ai npm account controls postcss, nanoid, browserslist, caniuse-lite, autoprefixer, and more. All flagged CRITICAL. Zero OIDC provenance.

Raccontata dadev.to