NPM has turned out to be pretty hard to lock down but we are figuring out slowly how to integrate it better with pants