We fixed this with installing npm proxy mirror. So each install happen from this proxy and if something missing it will be downloaded and saved for later from central.

In this case we always have the same dependencies that we have locally. But of cause this means you need own box with proxy.

(in our case it is nexus)

Probably the only ongoing issue I have with the node ecosystem (other than the general poor taste of JS developers, which is forgivable) is everything around versioning.

I don't understand how npm ended up the way it has--Bundler got it right, other people got it right...why isn't this a solved problem?

I know they're making it better, but then they go and do something like making a for-profit company out of it and I get nervous again.

Hell, package management in Elixir (http://hex.pm) works great.