add vendored npm script

This patch is helpful for complicated node apps that want to do their own npm stuff (e.g. Mozilla Persona w/ npm-lockdown)

Could DRY by just having the run_npm function use the vendored script too