Left-pad is back in NPM, but that really doesn't the address the underlying issues. I don't know what we're going to do really. Hoping a new set of "best practices" for dependency management reveal themselves in the next few days.
Checking our node_modules folder into source control (and avoiding ever 'npm install'ing again), seems like a bad idea. NPM "shrinkwrap" seems like it could work, but not if the modules disappear from NPM. Creating our own NPM mirror and disabling "unpublish" seems plausible, but is it worth the effort? Idk... I'm considering assembling our node_modules folder from github commits rather than npm package names, but that's only a solution if all of our dependencies are doing the same thing (otherwise we're still tied to NPM in some way and vulnerable to packages being unpublished). And of course things can be taken down from Github just the same...but at least Github is namespaced to the username. I think the only "good" solution is to disable unpublishing from NPM...but that's completely out of my control.
Back to the fetal position...