zlacker

> npm packages

This has nothing to do with what I said. npm is not a trusted or a FLOSS repository.

> we don't live in fairyland

When did you see a malware in Debian's repositories last time?

>>fsflov+(OP)
https://en.wikipedia.org/wiki/XZ_Utils_backdoor

>>jovial+t63
It never came to Debian and was a work of a tremendous effort. This almost never happens, and when it does, practically nothing can protect you.