tar dependence in package.json