Once CRA reporting obligations kick in, vendors will discover that their entire supply chain runs through one unmaintained npm package held together by duct tape and a guy named Jimmy