This doesn't work if the pulls are happening in swarms of ephemeral sandboxes.

Also, maybe FUD, but is there anything useful to learn from (p)npm other than cautionary tales?