"If you are paranoid about depending on the npm ecosystem, you should run a private npm mirror or a private cache. If you want 100% confidence in being able to

"If you are paranoid about depending on the npm ecosystem, you should run a private npm mirror or a private cache. If you want 100% confidence in being able to reproduce the specific bytes included in a deployment, you should use an additional mechanism that can verify contents rather than versions. For example, Amazon machine images, DigitalOcean snapshots, Heroku slugs, or simple tarballs." https://docs.npmjs.com/misc/faq#should-i-check-my-node-modules-folder-into-git https://docs.npmjs.com/misc/faq#should-i-check-my-node-modul...