Possible issues:

- trust

Not an issue since if you trust an author’s packages on npmjs you should also trust them from unpkg, github, etc... (Aka there is no trust in npm land except trust in the author)

- Versioning

Put the version in the url instead of some json, same difference.

- Lack of ^ for automatic upgrades

That’s a feature. Avoids the need for lock files.

- Repetitive

Have a dependencies.ts to group external imports, same thing as package.json

Any other issues?