wallets using npm were hacked via npm malware in many occasions before i am not aware deep details - this is one loophole github verify pgp identity n sig is must also