[paulddraper]

npm has always downloaded to the current directory.

[Maskawanian]

That isn't the same as vendor-izing unless you are committing node_modules to your VCS, which would be insane.