second take on npm update