npm: no shrinkwrap