npm.orig -> npm.real to avoid npm's -g hack