sorry if i wasn't clear. the fact that npm lets you choose an option with downgraded security (the first option) blows my mind.