When CRA enters into force, vendors will discover that their entire supply chain is one unmaintained npm package held together by duct tape and a guy named Dave