Like is-even or leftpad?

Like requests and pytest and ruff and so on, yes.

Rewriting the world to protect against a specific kind of threat is insane.

It's not there isn't good libraries everywhere. It just the practice around NPM that people are appalled with. It's all about lowering the barrier for developers, even in spite of security and quality.