3 ms·

> no single point of failure I have no solution to this but replacing npmjs.org with github.com might not be the answer. Wonder how a torrent-based package man

• krapp 11y ago
  I'm assuming that the github: key implies the possibility of non-github repositories being allowed. PHP's Composer does the same thing in a slightly more verbose way to support arbitrary repos and multiple VCS types. Packagist is less a centralized repository as a suggested but not necessary first choice, which in my opinion is how it should be. It also uses a JSON file to define project dependencies. Probably not the worst model to copy.