You can clone with
HTTPS or Subversion.
If npm has any per-project config, it would be best to put this option there. I guess this place is package.json, perhaps where we name the key save
Options could include ~, latest, and exact
latest is never the Right Thing™. exact is more worthy of consideration, but ~ is pretty much the Right Thing™.
Use npm install --save-exact or https://www.npmjs.org/doc/misc/npm-config.html#save-exact
npm install --save-exact
Prefix can be changed with https://www.npmjs.org/doc/misc/npm-config.html#save-prefix