If you make use of the NPM ecosystem you are inviting security holes into your product. Stay away.