Steal gained the ability to use NPM packages about a year ago and it has become indispensable in development of DoneJS apps as it allows you to use the full NPM ecosystem to build rich applications.
The easiest way to get this to work initially was to load all of your app’s package.jsons up-front so that everything would be configured properly. This was not ideal because it meant apps with a lot of dependencies would load slower as Steal had to crawl deep node_modules folders. This lead to adding npmIgnore options to prevent loading unnecessary package.jsons.
This helped but was never ideal. All along we wanted to make it so that Steal only grabs package.jsons when needed, such as when your code does something like: import _ from 'lodash';
Steal will be gaining this ability in 0.14.0, the next minor release. It’s available today as a pre-release, just npm install steal 0.14.0-pre.6 (and if you need to build, steal-tools 0.14.0-pre.0) and try it out in your app. Note that there may be bugs. I hope not, but am still in the middle of properly testing this myself. If you find any, please file an issue on GitHub.