It's pretty easy to find that the example I gave isn't gamed... A cursory search on GitHub can find a couple examples like dotenv [1] and npm's cli [2] both use

It's pretty easy to find that the example I gave isn't gamed... A cursory search on GitHub can find a couple examples like dotenv [1] and npm's cli [2] both use it via an older version of nodejs/readable-stream [3]. There's also the classic left-pad debacle - https://github.com/left-pad/left-pad/issues/4 https://github.com/left-pad/left-pad/issues/4 [1] - https://github.com/motdotla/dotenv/blob/master/package-lock.json https://github.com/motdotla/dotenv/blob/master/package-lock.... [2] - https://github.com/npm/cli/blob/latest/package-lock.json https://github.com/npm/cli/blob/latest/package-lock.json [3] - https://github.com/nodejs/readable-stream/ https://github.com/nodejs/readable-stream/