NPM doesn't change anything here. the same issue would exist if you could only vendor dependencies.

Are you sure you understand the issue?

Programming was a mistake.

Javascript was a mistake

Edit: Answer to “always_good”:

If a toddler shoots himself with a handgun, we can say that his mistake was pulling the trigger.

While technically correct, it’s not addressing the real issue, that is, how did the toddler get hold of the gun in the first place?

Wrong again.

Passing user input into arbitrary shell commands is the mistake.

Good examples of amateur criticism that plagues our field, though.

This isn't a case of JS gun gone wrong. Someone's passing cat inside exec with an arbitrary path instead of using native open&read and path.join. That's a thing possible in almost every modern language.

Stop the nonsense. Seriously. Stop.

Having the ability to execute arbitrary commands isn't something that's unique to JavaScript.