the package.json would be full of symlinks, not actual remote deps