Shrinkwrap isn't quite the same. npm install --save seems to be the closest equivalent, based on discussions I've had with people.

Vendoring means having the physical source code on hand. Not version numbers, not SHAs -- actual checked-out code.