Hacker News Reader

check them into your git

How does that help? You still update from time to time get fixes, new features and then you can get some unwanted code which is not discovered yet.

it enables you to run git diff after updating your npm dependencies, so you at least have a chance to detect something shady

In this situation, wouldn't it tell you the package had a version bump?

and/or use fixed versions with package-lock. Or private npm cache if you are concerned.