Re: We don't have a package manager
I don't really see how you fix systems like NPM & Maven...
1) They make it far easier to pull in unnecessary and dangerous dependencies
2) Consequently they make it a lot harder to for developers to actually understand and reduce the dependencies.
They are working as they are intended to work, I'm not sure how you can "fix" them beyond limiting yourself to a subset of "trusted" upstream repos and hope for the best. Sometimes a bit of impedance to development is a good thing, it's the universe's way of telling you that what you attempting is a bad idea (in this case accumulating a large & complex set of dependencies).