Any module that I require that is not in my module itself is listed in my package.json and generally does not produce side effects when they are required.
All my modules are installed locally in node_modules (as opposed to globally) in order to prevent unintentional side effects of upgrading a global module that works in one of my modules but upgrading breaks a different one of my modules.
If I need to use an executable from a require, I install it via NPM and use node_modules/.bin with require('child_process')
Doing all of this allows for very strict compartmentalization and not dependency on the system environment being set up for me beyond an `npm install`.
If I am doing dev on one of my modules and need to test the new dev module against another module that requires it I use `npm link devModule` rather than deploying out stuff to NPM. Finally, when a deploy is ready I remove the link and install from latest to ensure what I pushed to NPM still works.
Basically, do everything you can to ensure the user doesn't need to set up the environment and you don't change the environment, because they will do it wrong, and you will get support issues about it.