The problem is that we need git commit hashes for this approach to work. I could not find a clear way on how to map a specific npm package version to git commit hash. If anyone could point me to how to do this we can certainly script it - and it would be much cleaner.