npm is distributing this credential tracker?