Distributing a self-replicating malicious code using NPM

There is a simple way to get your NPM credentials. Using the obtained credentials, I can spread the worm to all users of your packages and get their credentials. We all know this and choose to ignore it.