Npm doesn't actually enforce this field, unless engine-strict is set (off by default).