npm-shrinkwrap [1] (mentioned in the article) is supposed to help with this; it makes a lock file (npm-shrinkwrap.json) that records the resolved version.
I think it got started being used at work (by stuff I wasn't working on) because trying to install old code that hasn't changed broke because some HTTP proxying middleware for Express changed APIs or something.