npm should require this with packages that have a large enough blast radius