The only reason we use NPM is because we are lazy. It's up on us to pick and support an NPM alternative.

The best alternative would still be cloning from GitHub or GitLab or any other source.

Instead, we are going to build services around the NPM registry

• npmcdn

Or even hiding NPM itself behind new names.

• bower
• jspm

Or mimic its behavior

• ied

But because we are lazy, we rely on NPM and blame them when lawyers and stakeholders together break the web.

You can use packages from Git repos, but discovery needs a centralized location. This is the case with gems, brew, apt-get, and other package discovery system.

Not just that...

When you are hosting, you are always hosted at a private body, be it Github, Amazon, Google, your hosting company, unless you own your data center.