3 myths about npm based threats