I think the term "package management system" is a bit over broad a term to talk about.

If we are talking about global shared dependencies, sure it may belong in the OS.

If we are talking about directly shared code, it may as well belong in the language layer.

If we are talking about combining independent opaque libraries, then it might belong in a different "pseudo os" level like NPM.