npm and the security of the open source supply chain:

An attacker intent on compromising a nearby endpoint or server could use this bug to hijack program flow at a point where the boot process still has access to sensitive components, like the endpoint’s TPM. This could be used to break disk encryption for cases where an attacker has short-term network access (and it would be even easier in a theft scenario).

— HD Moore, creator of Metasploit and chief research officer at security firm Dragos, discussing the potential consequences of the UEFI vulnerability.