just spent an hour debugging a project and it's all because of some obscure dependency that npm decided to update automatically.