Never use “npm install”, only “npm ci”. Using “npm install” is a willing act to run fresh exploits.