It's not NPM's fault, it's developer's fault.

I would never in my right mind publish a one-line package, Python, Javascript, whatever.

And I would never add a one line package as dependency