I had a working prototype of this working which is why you get a HTTP 200 (OK) when going to https://gohugo.io/npmjs/katex
The idea would be that NPM packages would work exactly the same as packages on GitHub etc., but the path would be a path to a Go Module proxy server (which is a spec):
[[module.imports]]
path = "gohugo.io/npmjs/katex"
You would then control version upgrades the same way you’d do with other modules.
If I remember correctly, the one blocker I found with this is that it doesn’t seem to be a way to do this with a localhost proxy (a server started by the hugo command).
We’re not currently scaled to set up such a thing on a gohugo.io server – and that will bring all kinds of trust issues into the mix.
This may be worth revisiting, as the concept is rather simple. But note that I’m not prepared to build something entirely special for NPM (e.g. module.npm.packages) as there are so many aspects of this (version selection, vendoring, transitive dependencies, version graph, go workspaces, replace) – as that would mean a … ton of work.
Note to self to track down my work on this: