"If you are paranoid about depending on the npm ecosystem, you should run a private npm mirror or a private cache.

If you want 100% confidence in being able to reproduce the specific bytes included in a deployment, you should use an additional mechanism that can verify contents rather than versions. For example, Amazon machine images, DigitalOcean snapshots, Heroku slugs, or simple tarballs."

https://docs.npmjs.com/misc/faq#should-i-check-my-node-modul...

I think if you are worried about this you should be using Dockers and Docker Hub.

Even when assuming availability, what about modules that change?

Either because authors "bugix" their existing versions and don't bother to increase the version number. Or because a malicious network actor delivered modified code.

That's why I prefer to add a SHA-256 hash/checksum to every downloaded dependency file. In some settings that hash might be more important than the actual version number.

Do you guys not use pip, and stuff? I'm surprised by all the confusion on this point. Package managers are part of modern programming platforms. Repos only need to have your code, not everyone else's.

That's a good point, I've never considered the possibility of a package I'm using disappear from NPM. I never check in my node_modules folder and let CI build processes handle all of that.

You could fork the libs and point to your own repo. That's what we usually did with Cocoapods.