Although the attacks on the NPM ecosystem are making that sound more like a liability by the day.