We use both directly. But maybe we should call npm as a subprocess. But I'd stay with using bower directly. It's API is quite clean.