NPM still has bugs from v5 which haven't been addressed and are ignored by it's maintainers. Problems with `npm link` were never fixed. There is a discussion on the NPM tracker where the maintainers tell Substack that his ( very correct ) assessment of an issue was wrong and lock the thread.

It's always the same usual suspects at NPM never accepting responsibility or blame for multiple incidents and ongoing quality issues.

NPM is currently on it's last legs before acquisition or buyout.