As someone who used npm since at least 2014, it was already fucked before Microsoft (who owns GitHub) got there to make things worse. That's why yarn and pnpm and bun and a few lesser knowns exist.