The problem here is not npm or the package itself.

The absurdity of 140k weekly downloads is a result of CI/CD practices.

I'm probably in the minority here but I think npm and github should actively disallow (or atleast discourage by making it very uncomfortable) to re-download the same dependencies from the internet on every pull request.