an “npm install” of an arbitrary NPM module doesnt necessarily give you all its dependencies