Damn, I didn't even know that npm allows publishing dependencies that have git/https dependencies to the public registry.