Dafuq did I just installed?

During the recent Axios Supply Chain Attack I have accidentally observed couple of devs checking whether they should be worried about their projects or not. I have noticed one interesting thing - the level of understanding of what's really going on, what is the nature of this kind of exploit and how to reliably protect yourself from future ones, is lower than it should be. Therefore, I decided to put together a few paragraphs that should help. I am far from being a Node.js security guru, yet I b