phew finally it works. I added .npmrc with a line

unsafe-perm=true

and included that in my BUILD file.