Lock down your npm dependencies by shasum.