Wrote about this in Slack but I wanted to properly voice my concerns so they don't get lost in Slack archives.
I think managing npm via CLJS is a bad idea. While this is very interesting it could/should probably happen in a library. We will inherit all the woes npm brings and force this onto the user. What if the user prefers yarn? What if the user is using a tool with support for package.json but not deps.cljs?
I voiced similar concerns a while ago  and with everything happening recently with regards to JS modules the situation is getting worse. It may appear that this work must happen in CLJS but really could happen somewhere else without making cljs.core more complicated. clojure.core doesn't bundle with leiningen for good reason.