> Imported packages are not pinned by default

What do you mean? The lockfile of all package managers is there for pinning the exact versions. For yarn and pnpm, installs on CI run automatically from lockfile only, for npm I think you still need to run `npm ci` instead of `npm install`. But this guarantees that no new versions get pulled automatically in by CI.

> Typescript / Javascript's lack of a standard library

That's true, but it's not an issue of the package manager / registry

> Post install scripts execute external code by default upon downloading dependencies.

They are disabled by default in all package managers now, the user needs to manually allow them

Two out of three of your points - the first and last - are just incorrect.

Ruby is worse. crates.io is arguably worse.