One thing is consciously sharing IP with third parties violating contracts, another is falling victim of malicious code in the toolchain.

Npm concern though suggests we likely work in very different industries so that may explain the different perspective.