Can you provide a link to that? That's not how npm works at all. You specify dependencies as a dictionary: keys are package names, and values are versions. They support commit hashes, but do not require them. See: https://www.npmjs.org/doc/package.json.html#dependencies