Just read a few good tips here[1]. Basically shrinkwrap and use a private npm server/cache.

1 - https://news.ycombinator.com/item?id=11354147