Worried about being rate limited or DoSing the server.

Sure, the need for backpressure occurs anyway, regardless of batching optimization.

Couldn't find any specific rate limit numbers besides the one mentioned here[0] from 2019:

> Up to five million requests to the registry per month are considered acceptable at this time

[0]: https://blog.npmjs.org/post/187698412060/acceptible-use.html