The difference with composer is that in most cases you're getting the exact version from github, including the full .git directory. No minification, no "the tarball doesn't match the source". And most composer packages have 0-5 dependencies, whereas most npm packages seem to have 10-20.
But too-many-dependencies is a problem there too.
not exactly, actually. composer allows you to pull "dist" version - which is an archive that can be whatever really. you can of course set "prefer-source", but I think theoretically you can have a package without source provided at all.