- use npmFileMap from npm tarball if present
- filter out malicious paths from filemap
- clean up some code