It’s hard to enforce on developer machines - there are lots of ways to install npm even if you never use it for managing development dependencies.

Which package manager is that, and what caveats does it offer?