I guess this is the hazard of having npm be part of the build environment. In that case maybe just add a comment explaining why we can't rely on `npm ls` without a `depth` parameter...