you can, you just need to use the built-in tooling to build a self-contained application like a zipapp. if package maintainers did that it would break less. but they don't, and the problem there is how big the packaging tooling is.

like, imagine trying to install a js-based program the same way as you describe, pulling each dependency from apt. it would break immediately.

also, none of those listed ones used the package index as the vector. solarwind had their own infrastructure compromised, colorama was a typosquatting attack, jarkastealer was malicious from the word go. the list goes on, none of these are packaging system failures.

he problem npm has had for ages is that people are taking over legitimate packages and adding malicious code into them downstream from development using npm, and that the js ecosystem favours many small dependencies which makes the attack surface huge.

now, if all of those you listed was due to revival hijacking it would be pypi's problem, but that only works if the original dev removes their package. as it is, all of it is upstream of pypi. it's bad opsec by the devs.