This is a large part of why, in my opinion, language-specific package managers are generally bunk (though language-specific packaging tooling is not necessarily

This is a large part of why, in my opinion, language-specific package managers are generally bunk (though language-specific packaging tooling is not necessarily so). I install all of my Python packages system-wide through my distribution's package manager, and if no package is available I make one. Distribution packages are cryptographically signed and reviewed by a dispassionate human being before being published, and are available on mirrors around the world to mitigate the single source of failure language repositories tend to suffer from. Of course, this is difficult for something like Node, whose package ecosystem is out of control.