Why does NPM's policy of duplicated deps work? https://stackoverflow.com/q/25268545 (JS practices around encapsulation tend to prevent problems)