Why not use requirejs to create some logical mapping between the node_modules and thirdparty folders?
I think @petetnt has done that in #12006
If we go on this route we probably need to do something for distribution. (I don't remember exactly but I think we don't copy the node_modules over there)

Not sure how to do any logical mapping here, but happy to learn. We could use a separate package.json file inside the src folder for production dependencies. That's how brackets-electron does it and that's how electron authors recommend electron projects to be done.

The other idea I had in mind was exactly putting a package.json inside the src folder.
Both cases seems better to me.
For the logical mapping @petetnt knows more.

One can use relative mapping with ../node_modules/... for the requirejs config so you can use deps from the root folder: https://github.com/petetnt/brackets/blob/petetnt/poc-thirdparty-with-npm/src/main.js#L68. Not sure if that works in browser though.

Closing in favor of #12972