Author here. This is currently at the stage of an afternoon thought experiment, but I’m interested in your feedback and help!<p>Probably the most important open issue is that simple names aren’t a sufficient identifier with a decentralized registry: you need a URL. So once Crom learns how to save package metadata, it should probably map any specified short name (e.g., `d3-format`) into a full URL (<a href="https:&#x2F;&#x2F;github.com&#x2F;d3&#x2F;d3-format" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;d3&#x2F;d3-format</a>) to ensure stability.<p>Mutable releases are also a concern, but Crom could save the hash of installed packages so you’d know if anything changed. And of course, since it’s decentralized, you could still have third-party registries that make immutable copies, if that’s your thing.