You can also look at virtualenv and carton; they may give you what you need.

Maybe you mean plenv instead of virtualenv? (AFAIK virtualenv is used for python projects)

Anyway, I think plenv helps in the sense that I can create application-specific repositories, instead of mixing dependencies for a lot of different applications, which could easily become a mess. From a security perspective, however, it remains the same situation, unfortunately.