Building a Threat Model & How npm Fits Into It