npm bundle deps grabs package.json + shrinkwrap.json at a given sha does npm install puts it in a tar serves it License MIT