npm is a security nightmare. the amount of trash packages and supply chain attacks waiting to happen is fucked. use pnpm if you actually give a shit about security.