Just today, someone posted an article about how malware can be distributed via npm:

"Harvesting credit card numbers and passwords from websites"

https://news.ycombinator.com/item?id=16084575

If you self-host a stable version, you'll have some time to hear about potential problems in a new version before updating it.