Due to a npm change, npm install modifies package-lock.json, which turns bots red (we check for modified files at the end of the script).

Blocking #892, #889, and any other PRs.