thanks for the pointer! renamed it to npm ci so it's still 'safe'