Sorry, I have no advice to give, the whole npm dependency nightmare horrifies me. Totally understand that this is not a problem of your making, though.

I guess you can use packages that use minimal dependencies, and pin those to specific versions.

Maybe look to convert to a language that doesn't do this? I realise that's a tough call, though.