pinned node and npm