This story is unavailable.

For #3 wouldn’t npm install’s shrinkwrap be a resolution to this issue?