core: move npm service to core package for shared dependency management