[crumpled]

I've had problems with NPM where a deep dependency was wrong for my system, and was tempted to solve it in the following way: fix the deep dependency in a cloned-project, and create github clones of every dependency in the chain that refers to it using the new package address in their package.json. That sounded wrong so I didn't do it.

One mechanism that could fix that problem, and the left-pad problem is to allow defining a package substitute in your root package.json file. Then you could swap out the dependencies of your dependencies.

packageReplace : [{source_name: 'left-pad', source_version: '1.0.1', target: 'https://github.com/foo/bar' }]

...something like that