npm is centralized to start with, so how is this a problem?