I think `dedupe` is now (i.e. in the most recent version of NPM) part of the install process, actually. So the only situation in which you end up with two copies of the same dependency is if two of your dependencies depend on incompatible versions of the same sub-dependency.