You definitely can point to specific versions. That being said, most package managers can contain malicious code and very few of them actually review their pac

You definitely can point to specific versions. That being said, most package managers can contain malicious code and very few of them actually review their packages. Besides, any company using NPM seriously probably has their own proxy in front of it, so there's no case of "the file might not be downloadable anymore" if that was already a problem with NPM itself.