npm is still a major pain in the butt. who thought it was a good idea to have millions of dependencies, some of which haven't been updated in years, living in the wild west of the npm registry?