&gt;<i>So, countering this risk is apparently a manual thing if one uses off-the-shelf tooling for Git.</i><p>Not so much off-the-shelf tooling for Git, its more off-the-shelf tooling for Node&#x2F;Ruby&#x2F;Go&#x2F;Rust&#x2F;PHP.<p>Nothing about Node&#x27;s npm <i>really</i> requires it to depend on a single GitHub, in fact I think you can use any Git repo. Its just that most tend to use a single Git repo, and there is no way to configure mirrors.