I find the following cons with NPM:
- shrinkwrap does not work as well as the alternatives in Bundler (yes, that's plural).
- specifying versions as git hashes does not verify the hash on "npm install"
- npm link is more awkward than using :path => in Bundler.
The big difference between NPM and bundler is that NPM allows common dependencies of dependencies to have different versions. This is usually awesome, except when it isn't -- it can cause subtle breakages if you try to pass an object from one dependency to another. This is very rare though, and if I had to choose, I'd choose the NPM behaviour.