I wonder if anyone use https://verdaccio.org/ https://verdaccio.org/ to vendor packages? In theory for each package one could: * npm install pkg * npm pack p

I wonder if anyone use https://verdaccio.org/ https://verdaccio.org/ to vendor packages? In theory for each package one could: * npm install pkg * npm pack pkg * npm publish --registry=https://verdaccio.company.com https://verdaccio.company.com * set .npmrc to "registry=https://verdaccio.company.com/ https://verdaccio.company.com/ when working with the actual app. ...this way, one could vet packages one by one. The main caveat I see is that it’s very inconvenient to have to vet and publish each package manually. It would be great if Verdaccio had a UI to make this easier, for example, showing packages that were attempted to install but not yet vetted, and then allowing approval with a single click.