npm's 'convenience' is just a euphemism for 'I have no control over my dependencies' - how did we go from 'please include your own dependencies' to 'let us install 400MB of crap for a 1KB library'?