non-private packages can be npm installed directly from github... who knew?