npm is a fucking security nightmare. you should never trust anything you install from there, it's a supply chain attack waiting to happen.