I would say the key is not relying on global installs. By default all NPM dependencies are installed locally alongside the manifest. You use more disk space, but disk space is cheap these days.