Our devs have been putting 3rd party deps in the package.json, which I believe is the sort of standard way to do it