add support for cloning non npm hosted deps into a repo

Won't this hashing cause `gh-user/packagename#master` to slowly go out of date?