This seems like something the qt.io guys should be taking up.
It's gorgeous because it does exactly what it's supposed to do, exceptionally well.
It's a piece of shit because every little thing you use has 3 billion dependencies which you have to validate and verify n some manner.
If you mean to prevent breakage, shrinkwrap lets you lock down dependency versions: https://docs.npmjs.com/cli/shrinkwrap
If you mean something else (security?) then I'd probably just not use npm, because as you said your dependency tree is going to be deep and reviewing all of that code is impossible.