It's not NPM's fault (well, other than wrt. the leftpad thing), it's all about the "community". The Javascript open source community is a dumpster fire.
The JS community is unstable, but in a way that produces useful things rapidly. Stuff just gets thrown out there and the good parts stick. Certain dampening factors protect you from the most dangerous effects of this (unless you live your life at the bleeding edge) like the jet's computer controlled micro-interventions protecting the pilot form how jittery the airframe actually is. Occasionally this goes wrong and the protection fails. "Leftpad" was one such matter that caused thing to crash and burn temporarily. Luckily unlike an expensive jet hitting the ground, the damage from such incidents is relatively easy to repair after the fact.
The throw-it-out-and-see-if-it-works part isn't the only issue with the JS community but it is a significant one and does relate to some of the others, though one that does provide some benefit in the form of forward momentum.
That the JS community is huge and overwhelmingly newer to the industry than (for example) me does not excuse bad behaviour. What it _does_ excuse is a lack of awareness of history and historical context. And the solution to that is education.
It pains me to see so many wheel-reinventions, both technical and social. But the flip side is that people who don't know something's not supposed to be possible will _sometimes_ manage to do it anyway.
NPM, on the other hand, seemed very much to be all about package management being a simple problem, and learned the hard way that there's a reason why other systems have more complexity.