don't commit node_modules in repo, instead use package.json to list dependencies