I did not realize substitution attacks were so common. Disabling dependabot alerts seems to be sidestepping a major security problem, hopefully Github (and NPM)

I did not realize substitution attacks were so common. Disabling dependabot alerts seems to be sidestepping a major security problem, hopefully Github (and NPM) come up with a more long term solution