Exactly, I've been thinking for a while that the lack of a package manager is really holding back qml adoption.
It's gorgeous because it does exactly what it's supposed to do, exceptionally well.
It's a piece of shit because every little thing you use has 3 billion dependencies which you have to validate and verify n some manner.
If you mean to prevent breakage, shrinkwrap lets you lock down dependency versions: https://docs.npmjs.com/cli/shrinkwrap
If you mean something else (security?) then I'd probably just not use npm, because as you said your dependency tree is going to be deep and reviewing all of that code is impossible.