migrate off of NPM

there seems to be no reason for this repo to use npm as it's just publishing json files, which the consumer can simply pull from github directly. npm introduces unnecessary attack surface as a compromised npm account/token can be used to ship malicious code (such as install scripts) to the consumer.