NPM: check dependencies recursively

Fixes #110 

The only other package manager that implements `children` is Bundler, and it only reports direct children.  So for consistency, that would be better.