A single Node of failure

I'm not so sure. Looking at other packages available on NPM it seems that even if Javascript had a sprintf (which is what lpad is called in most other languages) there would still be a package on NPM that just calls sprintf with the right arguments or so.

Heck, there's even a package "is-positive-integer" that depended on three other packages *and* made breaking API changes in the past! It's hard to believe this is not a joke.