Update dependencies and move from yarn to npm

[domenic]

Notably, we can remove the minipass-fetch dependency as new Node.js versions have fetch() built-in.