package.json lists node dependencies