iirc yarn has a bug regarding `which` cli which is similar to this.

bugs are bound to happen and it's part of software development. however, the team size of npm cli and the way they react to this incident are what make me concern more.