using npm shrinkwrap to lock down dependencies