The part about the package ecosystem is not true. Check out luarocks [1]. It's not as well developed but it's certainly there.

1: http://luarocks.org/