diff --git a/README.md b/README.md
index cb6b1df0..03d2bdfc 100644
--- a/README.md
+++ b/README.md
@@ -8,6 +8,12 @@
 
 - [Node.js](https://nodejs.org/en/) at least `8.x.x`
 
+## Usage
+
+`vsce` is meant to be mainly used as a command line tool. It can also be used a library since it exposes a small [API](https://github.com/microsoft/vscode-vsce/blob/master/src/api.ts).
+
+> **Warning:** When using vsce as a library be sure to sanitize any user input used in API calls, as a security measurement.
+
 ## Development
 
 First clone this repository, then:
diff --git a/src/npm.ts b/src/npm.ts
index 71649a43..e5188880 100644
--- a/src/npm.ts
+++ b/src/npm.ts
@@ -54,7 +54,7 @@ function checkNPM(cancellationToken?: CancellationToken): Promise<void> {
 
 function getNpmDependencies(cwd: string): Promise<string[]> {
 	return checkNPM()
-		.then(() => exec('npm list --production --parseable --depth=99999 --loglevel=error', { cwd, maxBuffer: 5000 * 1024 }))
+		.then(() => exec('npm list --production --parseable --depth=99999 --loglevel=error --link=true', { cwd, maxBuffer: 5000 * 1024 }))
 		.then(({ stdout }) => stdout
 			.split(/[\r\n]/)
 			.filter(dir => path.isAbsolute(dir)));
diff --git a/src/publish.ts b/src/publish.ts
index 8b4b4060..3c7d7266 100644
--- a/src/publish.ts
+++ b/src/publish.ts
@@ -73,7 +73,7 @@ async function _publish(packagePath: string, pat: string, manifest: Manifest): P
 
 			return promise
 				.catch(err => Promise.reject(err.statusCode === 409 ? `${fullName} already exists.` : err))
-				.then(() => log.done(`Published ${fullName}\nYour extension will live at ${getPublishedUrl(name)} (might take a few seconds for it to show up).`));
+				.then(() => log.done(`Published ${fullName}\nYour extension will live at ${getPublishedUrl(name)} (might take a few minutes for it to show up).`));
 		})
 		.catch(err => {
 			const message = err && err.message || '';