At this point node_modules is just the npm equivalent of an open carry state.
@andrewnez to who? Hoping it's not an extraordinarily bad actor. In the current sense.
I don't use npm intentionally, never have. But it's inescapable. Unless every thing you write is pure vanilla javascript.