It worked out for the time being, but npm destroyed the illusion. I don't even see the problem. A package manager could rely completely on git with the advantag

It worked out for the time being, but npm destroyed the illusion. I don't even see the problem. A package manager could rely completely on git with the advantage to not have an single authority that isn't giving a flying fuck about quality and security of the hosted packages. Yes it forces you to dig out a good package, evaluate it and look at the track record of the devs. Someone has to do it, but it is currently hardly happening.