[tomc1985]

As the other comments here have alluded,

a) a typo can run unintended code on your box

b) a bad/old/hacked project (correctly typed) can run unintended code on your box

c) both of the above conditions are considerably more severe because they can be triggered with near-zero friction (unlike a gemfile, which are manually pulled-down and code is run from a separate command. Gemfile results are also generally small enough (1-2 pages) that one can visually spot typos if you are monitoring the output

d) complex dependency systems can often turn into dependency hell

e) (IMHO) instantly-available dependencies potentially reduce a given programmer's likelihood to attempt to solve their problems with the language itself (i.e. don't use Cassandra when a Dictionary will do) ... the nodejs community seems especially susceptible to this

That's all I can think of right now...