I'm trying to figure out if all you need to "opt-out" of 99% of NPM supply chain attacks is to use npm ci, not npm install, see https://stacker.new...