Could you use the JSR package registry instead of setting up a new one?
Implementing, running, maintaining, scaling a module registry is probably not worth the time. Unless there's a clear technical requirement from the runtime. I would think there isn't since npm protocol compatibility is a stated goal/feature.