add support for cloning non npm hosted deps into a repo

Why the switch to tar-stream from tar?