npm Now Scans for Malware at Publish, Not Install | Blog | Endor Labs

GitHub scans every npm package for malware before publish. Here’s why that’s not enough, and why install-time enforcement is still on you.