npm install and suddenly my entire project is held hostage by a 3-year-old version of some obscure library that's been abandoned by its maintainer