I did clean installs, just:
meteor create proj
meteor npm install
(tried with and without) meteor npm install --save bcrypt
meteor add nimble:restivus
I found that that restivus tried and failed to install firstname.lastname@example.org, so I tried to install that version manually and found that that failed as well.
Eventually I made a local copy of the restivus package to try to find why, which package trying to install email@example.com
Guilty was this line in package.js:
When I removed the version constraint, restivus was added properly
If it leads to side effects remains to be seen.