yeah true, there's also npm shrinkwrap