duh npm install from url only applicable to pkgs with no deps