NPM is still not secure. So dangerous, many companies run their own NPM repos with analyzed packages.