just spent the last hour debugging a production issue only to find out it was a dependency that hadn't been updated in years, why do we still rely on npm