Inlining the npmcli dependency is really unnecessary and insecure. It makes the package size way too large and makes the package really hard to audit.