Currently doing an npm install will read the top level package.json and resolve dependencies. If those dependencies have sub-deps defined, it'll grab those too. However, if a top level dependency is already present but it's sub-dependencies are not, npm install does not recurse and fetch these.

This comes up in the specific case where we have a project, P, with a package.json and dependency D. Instead of managing all dependencies through npm, we want to bundle D along with it because we have a fork and it's easier for us to maintain that way. However we don't want to include Ds dependencies. We want those to be updated via npm when we deploy.

npm update works this way right now.