Hacker News Reader

There's already a good solution, it's called git-vendor [0]!

[0]: https://brettlangdon.github.io/git-vendor/

Duplicates https://news.ycombinator.com/item?id=11364190 , badly.

> no single point of failure

I have no solution to this but replacing npmjs.org with github.com might not be the answer. Wonder how a torrent-based package manager might work..

I'm assuming that the github: key implies the possibility of non-github repositories being allowed. PHP's Composer does the same thing in a slightly more verbose way to support arbitrary repos and multiple VCS types. Packagist is less a centralized repository as a suggested but not necessary first choice, which in my opinion is how it should be.

It also uses a JSON file to define project dependencies. Probably not the worst model to copy.

Screw npm – it's time for change