[brundolf]

Technically you could pin directly to a git commit instead of an NPM release

[hoten]

Although npm supports lifecycle methods that run before publish / on install, many packages fail to use those correctly (or at all) yet still require a build step, so using the GH repo directly very often does not work.

[paraknight]

This is the right answer. Everyone else replying is patently wrong.