How npm worms steal your credentials, and the order to rotate them in

Almost every npm supply-chain advisory ends with the same instruction: rotate every credential the...