fix: use promises to prevent npm install-ing the same directory by many requests at the same time