use npm-shrinkwrap  instead package.json