It does store them locally. I think the problems here are: - The missing packages can be replaced by someone who wasn't the original package author (e.g. a mal

It does store them locally. I think the problems here are: - The missing packages can be replaced by someone who wasn't the original package author (e.g. a malicious hacker) - It's not easy to catch this ^^^ because NPM doesn't have support for signing versions in your project's dependency configuration... (I bet it will after this.) - Almost every modern website has a dependency on NPM somewhere in their build chain - NPM being down means loads of sites can't deploy properly So yeah. This may be a really big deal.