Artifactory is another competitor but last I checked npm and Docker registries required the paid version.
No, but we have had multiple failures with various tools when attempts to remove the remote dependencies came into conflict with not particularly unusual real world requirements. This is a pretty serious flaw in the JS ecosystem right now.
Unfortunately I can't offer much constructive advice here. We have found no good solution so far that doesn't have significant limitations, except in the case that all of your developers are in the same place and you are willing to literally clone the entire thing also in the same place, have everyone use that one clone, and incorporate the necessary maintenance work into your processes (which is a viable if somewhat awkward strategy if these constraints are acceptable in your situation).