package.json supports urls, git urls (and branch + commit ids), even local file paths. If you wanted that, what's stopping you?