drop bogus npm dep