I mean what are these devs doing that they are day-1 updating npm packages still?

How many instances of this are required before npm package maintainers learn?