In the first five months of 2026, security researchers have flagged more malicious packages on the npm registry than in all ...