TIL: Your internal npm package name is a loaded gun

I was poking at a web app for a security assessment this week and ran a quick check on one of its dependencies, redacted-generic-plugin-name. Sounds real. Plausible. I curled the registry.