[nostrademons]

You should ensure that they are somewhere under your organization's direct control and you can do a build without going out to the Internet. It's incredibly dangerous to have your build process depend upon random code pulled from the Internet, as left-pad showed.

Whether that means checking it into your VCS depends on which VCS you use. In general, Git does not handle large binaries well. Check out git-annex though, or use a package manager that lets you setup a local mirror.

[jrowley]

For those curious, yarn supports a local offline mirror:

https://yarnpkg.com/blog/2016/11/24/offline-mirror/

[hjjiehebebe]

Yes since dependencies should be immutable given a version number, a backed up file share is suffcient for storage. Nuget allows this. I'm sure maven is similar.