My point being that "NPM is bad for security" is probably the wrong take to convince a software team to avoid the ecosystem. Instead, phrase it as, "well obvio

My point being that "NPM is bad for security" is probably the wrong take to convince a software team to avoid the ecosystem. Instead, phrase it as, "well obviously we need to review our dependencies, so why use an ecosystem where that's hard?" Don't phrase it as a security problem, phrase it as a development time and overhead problem. Or better yet, let your team use NPM as long as they review the dependencies, and if your dependency tree is really a problem, your team will naturally become annoyed by the extra work and will avoid large dependencies on their own without a lot of extra prompting.