this issue is avoidable by using shrinkpack:

HN: Shrinkpack – npm dependencies as tarballs, prevents “left-pad” style breakage - https://news.ycombinator.com/item?id=11353908