Because then it's extra hassle and expense for new developers to publish a package, and we're trying to keep things decentralized.

Decentralized? This is a centralized package registry. There is nothing decentralized about it.

It's already centralized by virtue of using and relying on NPM as the registry.

If we want decentralized package management for node/javascript, you need to dump NPM - why not something like Go's system which is actually decentralized? There is no package repository/registry, it's all location based imports.

I don’t understand what benefits this kind of “decentralization” offers