Do you have a Component or Asset object for that NPM artifact? If you do, Asset::getComponent gives you the Component, which has Component::version.
However, your code snippet suggests you may have only the request context. In that case you need to remember that some of your request will be for metadata file that does not have any version associated with. If your context is from request for a tarball, then your code should be working fine, but if your request is coming for a metadata you need to obtain the tarball to get version (this is how npm client works).