The question nobody asks Your CI/CD pipeline runs npm audit on every push. It checks for known CVEs. It found zero issues with axios in March 2026 — days before the maintainer's npm account was compromised. I wanted to know: what does the structural risk picture look like for the most-downloaded packages in the npm ecosystem? So I audited every npm package with more than 10 million weekly downlo