"npm audit: Broken by Design" by Dan Abramov https://overreacted.io/npm-audit-broken-by-design/

I'm so glad someone finally said this. The current situation is a huge mess.