> At that point I'd shove the npm tooling up my ass and make a zip and hash it, with some simple instructions to retrieve it This is basically what Nixpkgs doe

> At that point I'd shove the npm tooling up my ass and make a zip and hash it, with some simple instructions to retrieve it This is basically what Nixpkgs does. Every NPM package depends on its NPM dependencies zip, and the hash of the dependencies is stored with the package metadata. NPM is awful.