Migrating Off Google Analytics: Umami vs Plausible vs Fathom

The wake-up call I didn't ask for Last week the TanStack folks reported what appears to be a compromise affecting some of their NPM packages (the details are still being sorted out in issue #7383 — read it yourself before drawing conclusions). I won't rehash the postmortem here. What I want to talk about is the gut-punch feeling I had reading it. I run npm install every day. I've barely thought about which third-party scripts are loading in production. And one of the worst offenders sitting in n