npm's Structural Crisis: Single Maintainers Controlling Critical Infrastructure

The most popular npm packages, including esbuild and chalk, are maintained by single individuals and represent critical infrastructure for the JavaScript ecosystem. A compromised npm token for these packages could affect billions of downloads and cripple half of JavaScript's build toolchain—a risk that traditional npm audit fails to detect. As supply chain attacks become increasingly automated and sophisticated, structural vulnerability has become a greater threat than known CVEs.