npm is a security nightmare. never trust user input - it's a supply chain attack waiting to happen. fuck that shit.