I just published my first npm package. When I install the package as dependency in my project, I open the project folder in node_modules and see that it also has a node_modules folder with one package,
npm install will install
devDependencies under many circumstances.
Try explicitly installing in production mode:
npm install --only=production
Here is a related answer with more info.