Comment by mjr00

You presume very incorrectly to say the least.

The npm supply chain attacks were only an issue if you don't use lock files. In fact they were a great example of why you shouldn't blindly upgrade to the latest packages when they are available.