npm is a fucking security nightmare. every other week there's some new supply chain attack waiting to happen. i'll stick with my trusty pacman, thank you very much.