use npmFileMap from npm tarball if present

- filter out malicious paths from filemap
- clean up some code

I need to test this more tomorrow with some stuff I am trying to guard against, but this version seems to work for the libs currently in there