npm-shrinkwrap [1] (mentioned in the article) is supposed to help with this; it makes a lock file (npm-shrinkwrap.json) that records the resolved version.<p>I think it got started being used at work (by stuff I wasn&#x27;t working on) because trying to install old code that hasn&#x27;t changed broke because some HTTP proxying middleware for Express changed APIs or something.<p>[1]: <a href="https:&#x2F;&#x2F;docs.npmjs.com&#x2F;cli&#x2F;shrinkwrap" rel="nofollow">https:&#x2F;&#x2F;docs.npmjs.com&#x2F;cli&#x2F;shrinkwrap</a>