[nevir]

It's poorly worded. The real problem is that _by default_ npm doesn't pin you to an exact version of a dependency.