I mean, I use NPM, but I'm making a small traffic news site with no APT enemies. If you're making a wallet and think "Yes, auto-updating dependencies sounds like a good idea," maybe you're not very good at security?