protect non-npm dependencies