When I ask software developers what their biggest security concerns are, I typically hear something about malicious code in their npm packages.