I got to the conclusion that boring is good enough, for me NPM is the best tool, is not that fast, but the installation speed is not that bad, considering how many times I need to run from scratch, the difference does not matter, it is stable and it's the default Node package manager, so I don't need to bother to install in CI any other tool, etc. My experience for long living projects is to stick with the defaults, because in a few years third party tools will change, it happen to my team with Yarn classic, now that we are with vanilla Node and NPM no worries, same with 3rd party dependencies, just use as less as possible.

Unless you care about security, stability, DX, speed and correctness then npm is fine choice.

Describing NPM as boring is a stretch. Given its security model, i think spicy is a far more apt label.

I have switched to pnpm already.

Npm likes to run package lifecycle scripts of your dependencies by default. You have to explicitly opt out of this.

It’s probably the worst package manager out of npm, pnpm, yarn, and bun.

I have the same experience - npm was bad, now it is fast enough.

yeah the problem is npm is now Microsoft, just like Github. I trust Node. I don't trust NPM.