I refuse to use npm at all. Too risky. I only use libraries if they can be added as a first-order dependency (i.e. in a script tag on the page). This is still

I refuse to use npm at all. Too risky. I only use libraries if they can be added as a first-order dependency (i.e. in a script tag on the page). This is still risky, but I can mitigate it somewhat. And at least I'm not giving a bunch of random maintainers commit-to-prod access in my core code.