Yeah, I've been down this road before with Java + Maven 10-15 years ago. Exploding dependency trees, DLL hell, etc. And I see it in the (admittedly mostly foreign to me) Node/NPM world. Quantities of third party dependencies with their own graphs can be trouble. At least with Maven there was a publishing/vetting process.

Still, it makes dev a lot easier.