Account takeovers - the compromise of legitimate OSS packages - were a big trend in 2025. In this talk, we look at why the npm ecosystem is a target for malware, what we can learn from several campaigns, the viability of npm security measures, and what OSS consumers can do to protect themselves.