Frankly, if you don’t want freeloading off your work, don’t use licenses designed to encourage freeloading., such as MIT. Use community building licenses like LGPL, GPL/GPLv2/GPLv3 and AGPL/AGPLv3. Or dual-license … LGPL for non-profits and a commercial pay-for-use license for profit-making entities.
Some people are angry that GitHub and NPM undid his modifications and locked his accounts. But if he's intentionally putting malicious code into a commonly-used public repository, that's the only responsible choice.
If your chosen 3rd party software repository would not intervene in that case, it is a good reason not to use anything in said 3PSR.