Security: Supply chain protection is bad

[paulmillr]

node_modules directory is 195.4 megabytes. All dependencies are using open-ended version ranges.

Any rogue dependency update (NPM acct of any of your dependency developer getting hacked) and near-api-js will spread malware and trojans, steal private keys. It's obvious 195 MBs of code has not been fully audited, so you don't even know what's there.

Steps required to fix:

1. Lock-down dependency versions, ensure the updates are rare
2. Reduce amount of dependencies. For example, bn.js, which is security-critical since it's used in crypto, can be completely removed.

These actions were done in ethereumjs libraries a long time ago.