why would the api depend on npm?