Are we implicitly deciding to manage external packages with npm here? I'm ok with that, but wanted to check that this makes sense going forward too.