npm's left pad debacle still haunts me - how can a single rogue package bring an entire to its knees, and yet we still haven't learned our lesson about dependency hell