As I sadly recently discovered when I went back and revived a node.ja project from 2 years ago.

This is an advantage of PHP's Composer over node.js's npm, as it can write your require lines for you, so you resist the temptation to put "*".