Proposal to Enhance Supply Chain Security Protections on NPM CLI

Hello, NPM Team

I propose that NPM implement an optional security check in the CLI that scans packages for obfuscated code.
If suspicious patterns are detected (e.g., excessive eval usage, long encoded strings), the CLI should display a warning like:

WARN: The NPM Package [PACKAGE_NAME] may be suspicious. Contains obfuscated code.

This would provide developers with early alerts against potential supply chain attacks.

I Propose This to enhance NPM and become a safe place for development.
A large number Of Supply Chain attacks occur, and a serious one on September
8, Sep 16, and others. By Implementing The Protection, this makes NPM
a safe place for developers

You Can Implement This by checking if This Version of the Tarball, after being extracted, Suspicious Obfuscated JS and Long Line JS code are indicators of a Supply Chain Attack.

No source file or test is named. Start by locating the CLI path that extracts tarballs and processes package JavaScript, then clarify which obfuscation patterns and opt-in behavior are acceptable. Done would mean an agreed detection scope, warnings for confirmed suspicious cases, and tests for the selected patterns.