Excuse me my snark comment, but npm doesn’t have a good story for dependency management either.
Maybe it didn’t have package signing, lock files, or deduping, but clearly it was popular in spite of those faults.
I hate all of them, use only when it’s almost inevitable, so I can’t really have an objective opinion.
Though it clearly worked well enough to be fantastically successful despite valid complaints about it.