Unnecessary? Maybe if more people had commented on JS devs tendency to include every 3 line micro packages in existence we would not be in this situation.

Every ecosystem has this problem but NPM is the undisputed leader if you count all attacks.