using NPM at all must be treated as a liability at this point. it's not the first and definitely not the last time NPM got pwned this hard.

Lots of very big financial originations and other F100 companies use a whole lot more node than you'd be comfortable with.

Luckily some of them actually import the packages to a local distribution point and check them first.