npm is a never-ending nightmare. who thought it was a good idea to allow arbitrary scripts to execute when installing a dependency?