YARN v2 onwards has Zero Install mode where you _do_ typically commit a cache folder to source control: https://yarnpkg.com/features/zero-installs

It can be a little tricky to get working with some tools, but it is very fast and doesn't take up as much repo space as you'd expect since the approach is much more efficient than node_modules.

An unfortunate solution because it might be the right one at the cost of maintainability and repo size

Or you could use a lock file

Lockfile doesn't help here. The packages were yanked from the repos. The lockfile will tell your package manager to try to download a package that does not exist. Checking in the entire node_modules folder saves you since you don't need to fetch any external files.

Good practive here is using package cache. It is not that hard to install, and your CI builds will save tons of trafic for you and for global package repos (Github, NPM, Packagist and so on)

Indeed, Go would not have failed here because the global package cache keeps deleted repos. Module authors cannot effect this

Other languages require you to run a cache and set proxy config up for the builders