ve never seen a software distribution mechanism as careless and sloppy as NPM. Bazillions of dependencies and no signing of packages. [ ... ]
Rust's cargo packaging system is almost exactly the same way. And the last time I looked, Go's packaging was very similar. And package signing won't help if the maintainer's key/cert has been exfiltrated and cracked.
This is what you get when you embrace DLL Hell -- the idea that you should pin your program to a single specific revision of a library, rather than, y'know, doing the engineering work to ensure that, as an app author, you're relying only on documented behavior; and, as a library author, to be responsible for creating backward compatibility for old apps linking to old entry points. Sticking to that principle lets you update shared system libraries with the latest enhancements and bug fixes, while remaining relatively sure none of the old clients will break.
"Sometimes you have to break backward compatibility." Agreed, but the interval between those breaks should be measured in years, not days.