Another one-line npm package breaks the JavaScript ecosystem