[marcosdumay]

If you remove the "regardless of size" part, you'll be describing any modern language dependency system.

And most of them also execute external code on module importation... what I'm not sure if it's even relevant, because you will run the module at some point anyway.

So, yeah, JS makes the problem one or two orders of magnitude larger. But the problem is still there, whether you use npm or avoid it.