I think it largely depends on how much of the critical infrastructure depends on NPM. Did you know that following the acquisition of NPM by Microsoft, one of t

I think it largely depends on how much of the critical infrastructure depends on NPM. Did you know that following the acquisition of NPM by Microsoft, one of the founders manually uploaded a package for old times' sake? I think that the uploaded contents didn't in fact match the commit/tag that they appeared to. I could be mistaken, it's been a while and I didn't keep detailed notes on that.