I don't see why codereflection needs to spell it out. The problems with npm, and JavaScript in general, are quite apparent to anyone who has used them. And if you haven't used them, a quick search engine search will turn up this information many times over.
It'd make sense to ask for such clarification if the information truly wasn't available elsewhere, and accessible with a quick search. But that's obviously not the case.
It's pointless to rehash this obvious stuff over and over and over and over again.