I strongly prefer Go's "option B" over node_modules. Your concerns (immutability, reliability, and general code existence) are handled by vendoring. Vendoring h

I strongly prefer Go's "option B" over node_modules. Your concerns (immutability, reliability, and general code existence) are handled by vendoring. Vendoring has the added benefit of enabling project builds without additional HTTP dependencies; entirely avoiding the "left-pad" problem class. I wish my NPM projects were so easy.