another day, another project held hostage by a single outdated dependency on npm