must always npm install, not update