npm should require this with packages that have a large enough blast radius

npm should require it for all packages.