npm audit: Broken by Design