npm does allow you to specify a repository url in package.json and warns when one isn't present.

I guess we may've gotten a little too happy with the centralised proprietary cloudy source distribution channel with a single point of failure...