Use more conservative assumptions for node_modules

[billyjanitsch]

Follow-up to #106.

We could use an override to be a bit stricter here, to account for third-party code using a wider range of language features than we do internally. (This will become more common over time as libraries transpile themselves less aggressively.)

We could potentially special case @kensho packages to use the regular assumptions there.