I know npm feels like wild west, but you can audit. Its quite a challenge to review imany of the C, C++, libraries out there that are just a .zip file stored in a website.

My point is that: Npm is auditable, trackable. I'm not challenging the bug itself, neither the security issue..