Not to mention the fact that npm is inherently insecure.

https://ponyfoo.com/articles/npm-meltdown-security-concerns

https://www.bleepingcomputer.com/news/security/52-percent-of...

https://github.com/joaojeronimo/rimrafall

https://github.com/npm/npm/issues/10999

https://twitter.com/o_cee/status/892306836199800836