There is a similar problem with Go dependencies in Debian (and Fedora for that matter). I'm not entirely convinced it still makes sense to insist on splitting the dependencies and mixing their versions stunningly at random hoping that if the build succeeded the resulting artefact works lin a fashion that the upstream developer intended. If the problem is about reproducibility, the upstream is already free to specify their desired versions of libraries, so why not treat the whole package (with vemdored dependencies) as a single artifact and call it a day? It's not like those dependencies can be separately updated like shared libraries. Packaging node apps this way would be pure madness, it's only that neither Rust nor Go have reached the same level of dependency hell that discussions like this are even held.