A simple replacement for `npm shrinkwrap`