Ok, I'll bite; which package repos are "the same or worse" than those of nodejs?

All of them. The issue at hand is not limited to a specific language or tool or ecosystem, rather it is fundamental to using a package manager to install and update 3rd party libraries.