At this point why not just avoid npm (and friends) like the plague? Genuinely curious.
I work for a company that needs to ship software so my salary can get paid
Can't you guys replace the most vulnerable parts with something better? I have been experimenting with Go + Fyne, it is pretty neat, all things considered.