Why do yarn and npm report more dependencies than snyk?