We used to use NPM shrinkwrap, but we stopped due to problems with @greenkeeperio-bot. We should reconsider. I'd also consider just checking node_modules into the repo (or ideally a separate repo connected with git submodule (Rule number 1: Never ever use git submodule, they are the worst).