My takeaway from the NPM mess is thus: languages should not shy away from large stdlibs.

I know they're incredibly expensive to maintain. But languages without usable built-in string processing, HTTP, or TLS implementations are setting themselves up for failure.

Rust is not as bad as JS, but it still makes me wary. Go's slow but steady adoption of "everyone-uses-them" third party libraries is a real boon. (And Python is sitting in a corner laughing at the rest).