add readme note about npm
security lib requires