>I would argue the problem is how dependencies in general are added to projects

I haven't done anything with this myself (just brainstormed a bit with chatgpt) but I wonder if the solution is https://docs.npmjs.com/cli/v10/commands/npm-ci

Basically, enforce that all libraries have lock files and when you install a dependency use the exact versions it shipped with.

Edit: Can someone clarify why this doesn't work? Wouldn't it make installing node packages work the same way as it does in python, ruby, and other languages?