There’s a ritual every JavaScript developer knows.

You’re building something. You need to parse a date, validate an email, or format a number. So you do what any reasonable person does, you open a terminal, type npm install, pick a package with four million weekly downloads and a friendly README, and move on.

For a long time, that felt safe. The...