I made a zero-trust npm wrapper that uses shadow execution and honey-traps to catch malicious packages (sec-npm)