Almost all programming languages now have similar standard package managers. I still remember back in the day when everybody would joke about how Maven downloads the whole internet on the first build. This is still true today for Maven, NPM, pip, composer, you name it. You are downloading hundreds of packages for which you implicitly trust their maintainer to not do anything shady. In case of Maven - and likely most others - packages are not even digitally signed by the publisher and on top of it are binaries, that you cannot easily inspect. I'd argue NPM is slightly better than that, at least it (often) includes the source code, though you still have illegible instructions in form of minified/uglified code.
I think NodeJS already has a decent stdlib and there will always be the need to pull dependencies in for basic functionality (apache commons, guava etc. in the Java world). That's just how OSS works. There should be a simple way to display and verify the chain of trust though.
I think NodeJS already has a decent stdlib and there will always be the need to pull dependencies in for basic functionality (apache commons, guava etc. in the Java world). That's just how OSS works. There should be a simple way to display and verify the chain of trust though.