WebAssembly is developed by the same corporations that own JavaScript.
Although Wasmer does come with a package manager (WAPM) that uses a proprietary registry like NPM, at least the developers have said they're committed to decentralized hosting[0]. Maybe someone can come up with a completely distributed package management alternative, which I would prefer, but at least Webassembly isn't yet at the degree of centralization that Javascript is.
And really, the only thing going for WebAssembly is being the PNaCL that those corporations were willing to agree on.
Certainly it's better not to have every aspect of a language be centralized. It's already near impossible to distribute Javascript, or even software in many languages, without going through NPM. WebAssembly, thankfully, isn't there yet.
A spec, which is under control of those organisations.