> The only problem is fetching packages from a central registry (registry.npmjs.org). As I understand and have implemented vendoring in the past, I have always

> The only problem is fetching packages from a central registry (registry.npmjs.org). As I understand and have implemented vendoring in the past, I have always thought of it as a "no external dependencies" solution. If your data center gets DDOS'd durring deployment, things should just work when the attack subsides (assuming you have access). Fetching packages from xxxx.npmjs.org would be sort of antithetical to that idea. Or am I missing something. Everythingstays seems like it would do the job mostly, as long as the "fall back to NPM" can be shut off.