Per a very interesting conversation I had, there is a vulnerability with using a package manager. Committing 3rd party packages to repo to prevent being affected by this vulnerability.