Following major supply chain attacks on NPM packages, security researchers argue for the immediate adoption of phishing-resistant authentication methods like passkeys.