Isn’t the whole node npm ecosystem now with AI a greater risk as before?

"which runtime" is a separate discussion from "which package manager"; there's nothing in Node requiring you to use npm (or to rely on external dependencies at all)