Friends don't let friends use npm