why do people think it's okay to just throw a bunch of dependencies in a package.json and call it a day? dont even get me started on how brittle the whole npm is.