npm bundle deps grabs package.json + shrinkwrap.json at a given sha does npm install puts it in a tar serves it See Also module-foundry License MIT