This is why the NPM warnings are such a problem too. https://overreacted.io/npm-audit-broken-by-design/