Повторюсь и здесь: "A cкорость не пробовали сравнивать ?"

И чем оно лучше чем пых ?

>Notable breakages
>
>   In March 2016, npm attracted press attention[5] after a package called left-pad, which was a >dependency of many popular JavaScript packages, was unpublished as the result of a naming >dispute.[6] Although the package was republished 3 hours later,[7] it caused widespread >disruption, leading npm to change its policies regarding unpublishing to prevent a similar event >in the future.[8]
>    In February 2018, an issue was discovered in version 5.7.0 in which running sudo npm on Linux >systems would change the ownership of system files, permanently breaking the operating system.[9]
>    In July 2018, the npm credentials of a maintainer of the popular eslint-scope package were >compromised resulting in a malicious release of eslint-scope, version 3.7.2. The malicious code >copies the npm credentials of the machine running eslint-scope and uploads them to the >attacker.[10]
>    In November 2018, it was discovered that a malicious package had been added as a dependency >to version 3.3.6 of the popular package event-stream. The malicious package, called flatmap->stream, contained an encrypted payload that steals bitcoins from certain applications. >npm administrators responded by removing the offending package.[11][12]