npm's dependency hell is still a thing. we've been working with a client who had a handful of transitive dependencies that weren't even used in their project. took us hours to weed them out.