I wonder if more people will look into adopting Deno[1], the new node alternative by one of the creators of Node. It does not use NPM, you pull in packages Go-style (via URLs[2]). It's supposed to be more secure because you have to explicitly give it access to anything (i.e. network, file system, etc).
[2] example import in Deno:
import { serve } from "https://deno.land/std@v0.36.0/http/server.ts";