On: You too can run malware from NPM (I mean without consequences)

[whilenot-dev]

> packages published to npm are immutable.

Depends how you'd refer to them... tags ("@latest", "@next" etc.) are not immutable and it's best to rely on the checksums in the lock file.