npm install, not update