I have no less than seventeen different point releases of lodash buried in my node_modules directory for one project. That's completely insane, but every plugin we use for something has it's own massive tree of dependencies, which have their own dependencies, ad absurdum, until I've got paths too long for Windows to be able to delete down in there.

Not to even get into the clusterfuck that is semver and how the default behavior with npm isn't to pin to a specific version of a package. It's bitten me in the ass several times lately because some dependency of ours will have a new patch version, and it completely breaks everything.

I'm living mostly on the back-end, .NET world. NuGet isn't great, but it's a breeze compared to fighting with JS-land. Packages are kept to a reasonable size, rather than fragmenting into micropackages, references only update when you tell them to, and stability is valued. Of course, you've also actually got a standard library, so you don't have to rely on third-party code for basic functionality.