npm confusion