NPM should, because NPM is a platform for people to download dependencies. However, I believe GitHub should not retain repos against the author's will, because

NPM should, because NPM is a platform for people to download dependencies. However, I believe GitHub should not retain repos against the author's will, because GitHub is a hosting site. As an analogy: if I upload an image to some web hosting platform / blog host / social media site / etc., and a lot of people hotlink it, and then I change or delete the image, that's my right. It would be wrong for the web host to decide the image is too popular and prevent me from touching it. But if I upload an image to Wikimedia Commons, it's no longer "my" image and Wikipedia has the right to keep using it even if I want to change or delete it. It would be wrong for Commons to let me modify the image retroactively. Consequently, build tools and package managers that use GitHub directly are an antipattern, just as much as if your makefile did "wget ftp://ftp.example.edu/~someone/whatever-1.0.tar.gz" and expected that to not change.