[the_duke]

Easiest solution without infrastructure imo is to vendor node_modules as a git submodule.

(Of course it's even easier to just add node_modules to the repo but that is messy).

[aabbcc1241]

and you better fork the git repo, otherwise the incident happening to npm can happen on github / whatever remote repo.