why do people still think it's okay to just randomly add a million dependencies to their npm