So npm install --save $pkg $sig?

Which means I have to look up the signature every time, and which point I might as well just install using the github repo. The fact that pretty much nobody uses that workflow today tells you something.

If its the token that bothers you, run this off the main chain with the transaction cost set to 0. No ether necessary.