Lock to specific version of npm

Probably the better solution is to update to use one of the modules
@isaacs split out of npm. But I'm lazy.