This is generally my line of thinking - theyre going to be responsible for keeping the package up to date and tested, I dont have to. But this is a good illustr

This is generally my line of thinking - theyre going to be responsible for keeping the package up to date and tested, I dont have to. But this is a good illustration of the extremes of that I think - if they put out a new architecture and it needed to be updated, that would be a major semver bump right? So my code isnt going to be automatically updated and chances are I wouldn't want it to be. And the risk here is huge at the moment - itd be super easy for this package to be compromised and switched out to do something nefarious. I think there are still going to be things more substantial where the upkeep and testing might be higher where the balance would start to tip back to outweigh the risks maybe, but I think personally I haven't been giving the risks enough consideration and I think thats where NPM needs to focus more of its attention.