Why is Snyk added into my production dependencies?