npm flaw