They appear deeper in npm ls --all. Their versions are chosen by npm and pinned in the lockfile.