Part of it is deliberately ignoring the lessons of the past because they seem like overkill. Python has the excuse that it is old enough to predate the lessons

Part of it is deliberately ignoring the lessons of the past because they seem like overkill. Python has the excuse that it is old enough to predate the lessons of Java and Maven. But the node and js worlds deliberately ignored things like namespaces and mandatory version specification because they were uncool. And then they had to introduce package-lock and typo-squatting defences because the complexity of the world isn't always negotiable.