Change:
bypassCache = true; reconstructLock = true; }; <del> "npm2nix-git://github.com/NixOS/npm2nix.git#5.12.0" = nodeEnv.buildNodePackage { name = "npm2nix"; packageName = "npm2nix"; version = "5.12.0"; src = fetchgit { url = "git://github.com/NixOS/npm2nix.git"; rev = "0c06be7d278a7f64fc853a5fd42d2031d14496d5"; sha256 = "e1b252cd883fd8c5c4618b157d03b3fb869fa6aad4170ef51e34681069d50bf5"; }; dependencies = [ sources."abbrev-1.1.1" sources."ajv-6.10.2" sources."ansi-regex-2.1.1" sources."aproba-1.2.0" sources."are-we-there-yet-1.1.5" sources."argparse-0.1.15" sources."asn1-0.2.4" sources."assert-plus-1.0.0" sources."asynckit-0.4.0" sources."aws-sign2-0.7.0" sources."aws4-1.8.0" sources."balanced-match-1.0.0" sources."bcrypt-pbkdf-1.0.2" sources."block-stream-0.0.9" sources."brace-expansion-1.1.11" sources."caseless-0.12.0" sources."chownr-0.0.2" sources."code-point-at-1.1.0" sources."coffee-script-1.12.7" sources."combined-stream-1.0.8" sources."concat-map-0.0.1" (sources."config-chain-1.1.12" // { dependencies = [ sources."ini-1.3.5" ]; }) sources."console-control-strings-1.1.0" sources."core-util-is-1.0.2" sources."couch-login-0.1.20" sources."dashdash-1.14.1" sources."delayed-stream-1.0.0" sources."delegates-1.0.0" sources."ecc-jsbn-0.1.2" sources."extend-3.0.2" sources."extsprintf-1.3.0" sources."fast-deep-equal-2.0.1" sources."fast-json-stable-stringify-2.0.0" sources."findit-1.2.0" sources."foreachasync-3.0.0" sources."forever-agent-0.6.1" sources."form-data-2.3.3" (sources."fs-extra-0.6.4" // { dependencies = [ sources."rimraf-2.2.8" ]; }) sources."fs.extra-1.3.2" sources."fs.realpath-1.0.0" (sources."fstream-0.1.31" // { dependencies = [ sources."graceful-fs-3.0.11" sources."mkdirp-0.5.1" ]; }) sources."gauge-2.7.4" sources."getpass-0.1.7" sources."glob-7.1.4" sources."graceful-fs-2.0.3" sources."har-schema-2.0.0" sources."har-validator-5.1.3" sources."has-unicode-2.0.1" sources."http-signature-1.2.0" sources."inflight-1.0.6" sources."inherits-2.0.4" sources."ini-1.1.0" sources."is-fullwidth-code-point-1.0.0" sources."is-typedarray-1.0.0" sources."isarray-1.0.0" sources."isstream-0.1.2" sources."jsbn-0.1.1" sources."json-schema-0.2.3" sources."json-schema-traverse-0.4.1" sources."json-stringify-safe-5.0.1" sources."jsonfile-1.0.1" sources."jsprim-1.4.1" sources."mime-db-1.40.0" sources."mime-types-2.1.24" sources."minimatch-3.0.4" sources."minimist-0.0.8" sources."mkdirp-0.3.5" sources."natives-1.1.6" sources."ncp-0.4.2" sources."nopt-2.2.1" (sources."npm-registry-client-0.2.27" // { dependencies = [ sources."semver-2.0.11" ]; }) (sources."npmconf-0.1.1" // { dependencies = [ sources."inherits-1.0.2" sources."once-1.1.1" sources."semver-2.3.2" ]; }) sources."npmlog-4.1.2" sources."number-is-nan-1.0.1" sources."oauth-sign-0.9.0" sources."object-assign-4.1.1" sources."once-1.4.0" sources."osenv-0.0.3" sources."path-is-absolute-1.0.1" sources."performance-now-2.1.0" sources."process-nextick-args-2.0.1" sources."proto-list-1.2.4" sources."psl-1.2.0" sources."punycode-2.1.1" sources."qs-6.5.2" (sources."readable-stream-2.3.6" // { dependencies = [ sources."safe-buffer-5.1.2" ]; }) sources."request-2.88.0" sources."retry-0.6.0" sources."rimraf-2.6.3" sources."safe-buffer-5.2.0" sources."safer-buffer-2.1.2" sources."semver-4.3.6" sources."set-blocking-2.0.0" sources."signal-exit-3.0.2" sources."slide-1.1.6" sources."sshpk-1.16.1" sources."string-width-1.0.2" (sources."string_decoder-1.1.1" // { dependencies = [ sources."safe-buffer-5.1.2" ]; }) sources."strip-ansi-3.0.1" (sources."tar-0.1.17" // { dependencies = [ sources."inherits-1.0.2" ]; }) (sources."temp-0.6.0" // { dependencies = [ sources."graceful-fs-1.2.3" sources."rimraf-2.1.4" ]; }) (sources."tough-cookie-2.4.3" // { dependencies = [ sources."punycode-1.4.1" ]; }) sources."tunnel-agent-0.6.0" sources."tweetnacl-0.14.5" sources."underscore-1.4.4" sources."underscore.string-2.3.3" sources."uri-js-4.2.2" sources."util-deprecate-1.0.2" sources."uuid-3.3.2" sources."verror-1.10.0" sources."walk-2.3.14" sources."wide-align-1.1.3" sources."wrappy-1.0.2" ]; buildInputs = globalBuildInputs; meta = { description = "Generate nix expressions to build npm packages"; homepage = https://github.com/NixOS/npm2nix; }; production = true; bypassCache = true; reconstructLock = true; }; </del> npm-check-updates = nodeEnv.buildNodePackage { name = "npm-check-updates"; packageName = "npm-check-updates";

Discussion:
is unmaintained, superseded by node2nix and should therefore be removed from nixpkgs Please run and paste the results.
seems LGTM. Wanna open a PR ?