people use npm/yarn directly most of the time, which might explain why it wasn't noticed