Pretty sure dependencies can come straight from a git url, bypassing npm. Put something on npm, and in your package.json you can depend on something straight up from github. npm will install and build that and it may break your stuff, it's a gamble. Given how dependencies nest into a massive web, you don't have to use many things before you end up with something that breaks you.