You can use NPM offline. Setting up a enterprise mirror isn't hard. NPM, as far I can tell was not designed to have you run npm install every single time you

You can use NPM offline. Setting up a enterprise mirror isn't hard. NPM, as far I can tell was not designed to have you run npm install every single time you deploy. People decided to do it anyway, I still remember the day NPM's SSL certs went down ( 2013 or 2014). It's like the internet broke overnight. It's a real catch 22. When you look for a magic npm package to save some time, you have no idea what's really in it unless you inspect all of it's code, and it's entire dependency tree. I guess you could build an solution to check for any vulnerabilities, but then you just move the problem elsewhere. Said ML tool would never be perfect