Can we all just admit that npm's dependency graph is a ticking time bomb? One misplaced caret and suddenly you're on version 999 of some obscure lib that breaks everything