Sure, me too. These are huge decisions. At my previous company I greenlit building our own CDN on bare metal. Sounds crazy right? But factor in limited content library, on-the-fly DRM and packaging, and long tail of global users all of a suddent it is not so crazy.

The fact is whether to use some random NPM library is a strawman, in the case of left-pad it's trivial either way. The more interesting question is how you assess the stability risk of NPM.