I prefer composer defaults. Always save dependencies to the composer.json (eay to forget --save) Always create a lock file when doing composer install

I do sort of like node's ability to recursively nest dependencies to avoid dependency hell. Though that has it's downsides too.. you will never know what is in your modules dir.