Personally, I find node_modules and package.json completely terrifying. A solution teetering on the brink of a catastrophic implosion. I have a moderate sized project that pulls in several hundred dependencies and dependencies of dependencies, any one of which could contain a supply chain attack when I upgrade my dependencies. Which I must do. Upgrading is not an option; but it's only a matter of time before I get hit.