How is npm not exactly that?