SebastianVerified account

You can even specify the tarball checksum if you append #HASH_HERE to the end of the URL! Yarn and npm should also handle caching it in the same way as a regular registry tarball.

Agree. It's like the killer feature of package.json that goes completely ignored. Wonder why. There's even a shorthand if you host your packages on GitHub! You can do: { "dependencies": { "react-router": "ReactTraining/react-router#v4" } }

Holy crap ... gist??!! So, like, nobody ever actually has to use the public npm registry if they don't want to. My mind is moving at a million miles a second right now...

I mean, people don't actually even need private npm if they don't want it. They can just use git+ssh, right? What is the core benefit of private npm? Security? Auditing?

Ya, I think you're right. You are paying to have somewhere to put your versioned artifacts so you don't have to keep them in your repo.