I think JS should be all source and no packages at all.
What about complex SPAs? Database drivers? Polyfills? TypeScript?
Pulling the source and compiling the package instead of pulling the package. Not much difference. Maybe slower build times but more secure and better builds.