While personally I think in the long run, every npm dependency has to be
provided as a recipe of its own (even I know the costs of that pretty
well)... esp when CVE checking and basic packaging hygiene should be
enforced.