few more tips here: https://github.com/bodadotsh/npm-security-best-practices