fix shebang for older shells
fix wrong tarball urls by fetching from npm