pinned npm to a working version