I would consider NPM's "millions of packages" with a big lump of salt.