If 'npm package update' includes the ability to modify strings in served pages, one would assume so.