npm is run by github / microsoft now, which also sells security products...