npm is a f*cking security nightmare. just use pnpm, it's way better.