It was rather hard and awkward, and there was no solution or support offered from npmjs-the-company. Some time after they introduced private (and hosted) npm repos as a paid offering, but this is still not what a lot of companies want. While perhaps I'm jumping to conclusions, a free in-house offering does not seem to be in their business model and therefore the community has suffered a bit.
(I'm aware of the unofficial projects for this)
Many other languages (well the ones I use frequently) not only have a recommendations on vendoring, but also support more than one path to getting the job done (with trade offs naturally).
https://books.sonatype.com/nexus-book/reference/npm-proxying...
There is. The only problem is fetching packages from a central registry (registry.npmjs.org). The rest that comes with the NPM CLI is good stuff.
One way, that I have been exploring is to allow NPM to download from IPFS instead, available over at http://everythingstays.com, and that's just one way it can be solved.
The top-level comment have more tools that you can use (but doesn't seem to have been implemented yet)
As I understand and have implemented vendoring in the past, I have always thought of it as a "no external dependencies" solution. If your data center gets DDOS'd durring deployment, things should just work when the attack subsides (assuming you have access). Fetching packages from xxxx.npmjs.org would be sort of antithetical to that idea. Or am I missing something.
Everythingstays seems like it would do the job mostly, as long as the "fall back to NPM" can be shut off.
Secondly, I think, by having a company deciding the fate of the code that we as developers are depending on, it's not a very good idea. There is a inherit conflict of interest between the community and the company. We want to have the code available at all times but the mission of the company is not the same. They care about being in the center of attention, so other companies can depend on them and they make cash. That's what being a business does to you.
What I see as the ideal world, is a way to have the best of the software already written (npm cli) combined with a distributed registry that works peer-to-peer. Not only does it solve the conflict of interest, but also scaling, offline access and long-term maintainability.
Many folks are working on getting there now, "gx" (package manager using IPFS https://github.com/whyrusleeping/gx ), "ipmjs" (distributed package manager https://github.com/ipmjs/ipmjs/ ) and my own work "everythingstays" (scripts that works together with the npm cli [ http://everythingstays.com/ ])
If you're interested in solving the problem in a bigger scale than changing npm inc's policies, I recommend you to check out the tools linked above.