Aren't there several sites that cache npm packages or redistribute over CDNs?

Though I agree, over reliance on just npm can be a bad thing (the 2016 issue over kik)