Awareness of how fragile npm is, both in terms of trusting it to always be available for your deploy but also on the mutability of packages there. What if someone unpublished one single well used package and someone else snapped it up to publish malicious code, it could have taken months before somebody noticed.