It is so typical that an entire package used to do only one tiny, simple thing could break much of the JS ecosystem. There's even a comment that the package consumers
can't do anything about it. How about... writing their own replacement in literally 5 minutes and removing the dependency?
If you don't think the JS ecosystem is fucking insane, you should now.
See: https://www.npmjs.com/package/left-pad