What do you expect? The userbase requires stuff like isinteger and left-pad as packages, I don't think they are capable of understanding basic security concepts

What do you expect? The userbase requires stuff like isinteger and left-pad as packages, I don't think they are capable of understanding basic security concepts. On another note, NPM is rooting for companies instead of users as has been observed by the leftpad debacle.