npm defers to the user at the first sign of conflict (which is actually the right thing to do in so many cases)