npm package list support

[tom--pollard]

This extends #99 to support npm, as part of the ongoing effort towards #83

[tom--pollard]

The behaviour of hard failing when hitting an unpublished(all existing versions removed, at the given point in time) package on the critical list seems sensible to me, however it should probably be aligned with how this is handled for the pypi implementation for a similar scenario. Any insight on this @Qinusty?

[Qinusty]

Minor point, otherwise looks good 👍

[Qinusty]

The behaviour of hard failing when hitting an unpublished(all existing versions removed, at the given point in time) package on the critical list seems sensible to me, however it should probably be aligned with how this is handled for the pypi implementation for a similar scenario. Any insight on this @Qinusty?

This could be quite problematic for a deployment with an NPM feed configured with many packages for critical polling. A single package being unpublished has the potential to prevent polling of all NPM packages specified.

[tom--pollard]

The behaviour of hard failing when hitting an unpublished(all existing versions removed, at the given point in time) package on the critical list seems sensible to me, however it should probably be aligned with how this is handled for the pypi implementation for a similar scenario. Any insight on this @Qinusty?

This could be quite problematic for a deployment with an NPM feed configured with many packages for critical polling. A single package being unpublished has the potential to prevent polling of all NPM packages specified.

Yes this is definitely a concern, it should be looked at as part of #107 and addressed along with other brittle areas