On the npm doomsday thing, the scarier version is someone vendoring it and the padding silently drifting between runs.