REV: use npm-shrinkwrap to limited npm version