This bug is meant to collect things that need to be done to safely manage, upgrade and audit npm packages in Koha.