title: Is it possible to blacklist a NPM package version either in the project or on the machine config?
body: <p>Given the <a href="https://www.theregister.co.uk/2018/02/23/npm_undoes_patch/" rel="nofollow noreferrer">news that npm 5.7.0</a> had some issues in production, I'm wondering if it's possible to blacklist a package version either in <code>package.json</code> or on the machine level perhaps in <code>.npmrc</code> or <code>.yarnrc</code>.</p>
  
  <p>The behaviour I'm expecting is that upgrades are possible, so this is not a fixed semver version. SemVer has intentionally avoided defining version skipping <a href="https://github.com/semver/semver/issues/233" rel="nofollow noreferrer">in the spec</a> because,</p>
  
  <blockquote>
    <p>SemVer is meant to communicate what type of changes have occurred, not
    'how much' change has occurred. If a user wants to know the details of
    how much has changed, they should look at the changelog. A long
    changelog tells them it's a big update.</p>
  </blockquote>
  
  <p>But as a user I may know beforehand that I <strong>never</strong> want <strong>this version</strong>. For example, never use 5.7.0 but 5.7.1 is ok.</p>