fixes the bug that npm does not properly deal with `^`