npm packages without version numbers are dangerous