This feels kind of gross to me, too, but it seems like the simplest solution to the problem. We already rely on NPM during development--using another package manager would be introducing new development dependencies. I'm open to other approaches, but  since this is completely an internal concern (it does not effect consumers of the library in any way), we can change it whenever we want.