> is there something fundamentally wrong with NPM?

Its users don't check who the email is from